CVE-2025-48459: Apache IoTDB: Deserialization of untrusted Data
Summary
Apache IoTDB deserializes data from external inputs without sufficient validation, allowing attacker-controlled serialized objects to be processed. In environments where a compatible gadget chain is reachable, this can be abused to execute arbitrary code or alter server state; at minimum it enables high-impact integrity and confidentiality compromise on the IoTDB process.
Affected
Apache IoTDB from 1.0.0 before 2.0.5.
Remediation
Upgrade to 2.0.5, which addresses the flaw. If immediate upgrade is not possible, restrict exposure of IoTDB endpoints to trusted networks and disable or sanitize any feature paths that accept serialized payloads. These mitigations are defense-in-depth only; upgrading to 2.0.5 is the definitive fix.
Other sources
Deserialization of Untrusted Data vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.5.
Users are recommended to upgrade to version 2.0.5, which fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.iotdb:iotdb-confignodeto a version that resolves this vulnerability.Fixed in 2.0.5 - Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.5 - Compensating control
If immediate upgrade is not possible, restrict IoTDB endpoints to trusted networks and disable or sanitize feature paths that accept serialized payloads.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48459?
CVE-2025-48459 is categorized as a high severity vulnerability due to the potential exploitation of deserialization of untrusted data.
How do I fix CVE-2025-48459?
To fix CVE-2025-48459, upgrade Apache IoTDB to version 2.0.5 or later.
Which versions of Apache IoTDB are affected by CVE-2025-48459?
CVE-2025-48459 affects Apache IoTDB versions from 1.0.0 up to, but not including, 2.0.5.
What type of vulnerability is CVE-2025-48459?
CVE-2025-48459 is a deserialization of untrusted data vulnerability.
What is the potential impact of exploiting CVE-2025-48459?
Exploitation of CVE-2025-48459 could allow an attacker to execute arbitrary code on the affected system.