CVE-2026-24012

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24012", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-20T02:30:29.932Z", "datePublished": "2026-07-06T08:38:25.308Z", "dateUpdated": "2026-07-06T20:37:56.860Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.0.8", "status": "affected", "version": "1.3.3", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Yan Nan (Detecon Security Lab)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in Apache IoTDB.&nbsp;</p><p>Some interface<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;fails to impose reasonable</span><span style=\"background-color: rgb(255, 255, 255);\">\nlimits on the time span and aggregation interval of the query.&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">An attacker</span><span style=\"background-color: rgb(255, 255, 255);\">\ncan construct a request with extreme parameters (e.g., a very large time</span><span style=\"background-color: rgb(255, 255, 255);\">\nrange combined with a minimal interval).&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">This forces the DataNode to build</span><span style=\"background-color: rgb(255, 255, 255);\">\nan enormous result set in memory, which exhausts the Java heap and causes</span><span style=\"background-color: rgb(255, 255, 255);\">\nthe DataNode process to crash.</span></p><p>This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.</p><p>Users are recommended to upgrade to version 2.0.8, which fixes the issue.</p>"}], "value": "Uncontrolled Resource Consumption vulnerability in Apache IoTDB.\u00a0\n\nSome interface\u00a0fails to impose reasonable\nlimits on the time span and aggregation interval of the query.\u00a0An attacker\ncan construct a request with extreme parameters (e.g., a very large time\nrange combined with a minimal interval).\u00a0This forces the DataNode to build\nan enormous result set in memory, which exhausts the Java heap and causes\nthe DataNode process to crash.\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-06T08:38:25.308Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T12:59:08.459706Z", "id": "CVE-2026-24012", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T12:59:14.486Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/06/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-06T20:37:56.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/06/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-06T20:37:56.860Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24012", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T12:59:08.459706Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T12:59:03.415Z"}}], "cna": {"title": "Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Yan Nan (Detecon Security Lab)"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache IoTDB", "versions": [{"status": "affected", "version": "1.3.3", "lessThan": "2.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in Apache IoTDB.\u00a0\n\nSome interface\u00a0fails to impose reasonable\nlimits on the time span and aggregation interval of the query.\u00a0An attacker\ncan construct a request with extreme parameters (e.g., a very large time\nrange combined with a minimal interval).\u00a0This forces the DataNode to build\nan enormous result set in memory, which exhausts the Java heap and causes\nthe DataNode process to crash.\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in Apache IoTDB.&nbsp;</p><p>Some interface<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;fails to impose reasonable</span><span style=\"background-color: rgb(255, 255, 255);\">\nlimits on the time span and aggregation interval of the query.&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">An attacker</span><span style=\"background-color: rgb(255, 255, 255);\">\ncan construct a request with extreme parameters (e.g., a very large time</span><span style=\"background-color: rgb(255, 255, 255);\">\nrange combined with a minimal interval).&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">This forces the DataNode to build</span><span style=\"background-color: rgb(255, 255, 255);\">\nan enormous result set in memory, which exhausts the Java heap and causes</span><span style=\"background-color: rgb(255, 255, 255);\">\nthe DataNode process to crash.</span></p><p>This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.</p><p>Users are recommended to upgrade to version 2.0.8, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-06T08:38:25.308Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24012", "state": "PUBLISHED", "dateUpdated": "2026-07-06T20:37:56.860Z", "dateReserved": "2026-01-20T02:30:29.932Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-07-06T08:38:25.308Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.0.8", "status": "affected", "version": "1.3.3", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:iotdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5DB00CF-13B9-44F8-9F24-70DFE24EB18E", "versionEndExcluding": "2.0.8", "versionStartIncluding": "1.3.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in Apache IoTDB.\u00a0\n\nSome interface\u00a0fails to impose reasonable\nlimits on the time span and aggregation interval of the query.\u00a0An attacker\ncan construct a request with extreme parameters (e.g., a very large time\nrange combined with a minimal interval).\u00a0This forces the DataNode to build\nan enormous result set in memory, which exhausts the Java heap and causes\nthe DataNode process to crash.\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de Consumo de Recursos No Controlado en Apache IoTDB.\n\nAlguna interfaz no logra imponer l\u00edmites razonables en el lapso de tiempo y el intervalo de agregaci\u00f3n de la consulta. Un atacante puede construir una solicitud con par\u00e1metros extremos (por ejemplo, un rango de tiempo muy grande combinado con un intervalo m\u00ednimo). Esto fuerza al DataNode a construir un conjunto de resultados enorme en memoria, lo que agota el heap de Java y provoca que el proceso del DataNode falle.\n\nEste problema afecta a Apache IoTDB: desde 1.3.3 antes de 2.0.8.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.8, que corrige el problema."}], "id": "CVE-2026-24012", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24012", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-06T12:59:08.459706Z", "version": "2.0.3"}}]}, "published": "2026-07-06T09:16:35.037", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/07/06/10"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.3.3,2.0.8)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache IoTDB", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "iotdb", "vendor": "apache"}], "created": "2026-07-06T11:45:05.382809+00:00", "updated": "2026-08-01T18:45:03.844284+00:00", "vendors": ["apache", "apache$PRODUCT$iotdb"]}