Apache
Apache Iotdb: vulnerabilidades y CVE
Apache Iotdb tiene 31 vulnerabilidades publicadas, 16 de ellas en los últimos 12 meses. 14 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE31
Últimos 12 meses16
Críticas14
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-44630 | Alta (7.5) | 0.59% | — | 10 ago 2026 | Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to… |
| CVE-2026-40454 | Alta (7.5) | 0.49% | — | 10 jul 2026 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects… |
| CVE-2026-40452 | Alta (7.5) | 0.43% | — | 10 jul 2026 | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache… |
| CVE-2026-40009 | Media (6.5) | 0.35% | — | 10 jul 2026 | Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue affects Apache… |
| CVE-2026-40008 | Crítica (9.8) | 0.60% | — | 10 jul 2026 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using… |
| CVE-2026-40007 | Alta (7.5) | 0.49% | — | 10 jul 2026 | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it… |
| CVE-2026-40006 | Alta (7.5) | 0.58% | — | 10 jul 2026 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the… |
| CVE-2026-40005 | Crítica (9.1) | 0.54% | — | 10 jul 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This… |
| CVE-2026-28564 | Crítica (9.8) | 0.68% | — | 10 jul 2026 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before… |
| CVE-2026-24014 | Crítica (9.8) | 0.69% | — | 6 jul 2026 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an… |
| CVE-2026-24013 | Crítica (9.1) | 0.64% | — | 6 jul 2026 | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An attacker can construct requests with a forged sessionId and,… |
| CVE-2026-24012 | Alta (7.5) | 0.74% | — | 6 jul 2026 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme… |
| CVE-2025-64152 | Crítica (9.1) | 0.54% | — | 26 jun 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to… |
| CVE-2025-55017 | Crítica (9.1) | 0.54% | — | 26 jun 2026 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to… |
| CVE-2026-24713 | Crítica (9.8) | 0.66% | — | 9 mar 2026 | Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the… |
| CVE-2026-24015 | Crítica (9.8) | 0.58% | — | 9 mar 2026 | A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue. |
| CVE-2025-48459 | Media (5.3) | 0.49% | — | 24 sept 2025 | Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue. |
| CVE-2025-48392 | Alta (7.5) | 0.60% | — | 24 sept 2025 | A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue. |
| CVE-2025-26864 | Alta (7.5) | 0.72% | — | 14 may 2025 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through… |
| CVE-2025-26795 | Alta (7.5) | 0.72% | — | 14 may 2025 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This issue affects iotdb-jdbc: from 0.10.0 through 1.3.3, from… |
| CVE-2024-24780 | Crítica (9.8) | 1.3% | — | 14 may 2025 | Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0… |
| CVE-2023-46226 | Crítica (9.8) | 1.9% | — | 15 ene 2024 | Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3.0, which fixes the issue. |
| CVE-2023-51656 | Crítica (9.8) | 1.0% | — | 21 dic 2023 | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue. |
| CVE-2023-24831 | Crítica (9.8) | 1.2% | — | 17 abr 2023 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3. Attackers could login without authorization. This is fixed… |
| CVE-2023-24829 | Alta (8.8) | 1.2% | — | 31 ene 2023 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB,… |
| CVE-2023-24830 | Alta (7.5) | 1.3% | — | 30 ene 2023 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. |
| CVE-2022-43766 | Alta (7.5) | 1.5% | — | 26 oct 2022 | Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this… |
| CVE-2022-38370 | Alta (7.5) | 1.3% | — | 5 sept 2022 | Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue. |
| CVE-2022-38369 | Alta (8.8) | 1.3% | — | 5 sept 2022 | Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue. |
| CVE-2020-25649 | Alta (7.5) | 17% | — | 3 dic 2020 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.