CVE-2026-24012: Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query
Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.8 - Compensating control
Mitigate ongoing DoS risk by restricting access to the DataNode/IoTDB query interface so attackers cannot send crafted aggregation queries with extreme parameters (e.g., very large time range combined with minimal aggregation interval).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24012?
CVE-2026-24012 has a high severity rating of 7.5 according to the CVSS v3.1.
How does CVE-2026-24012 exploit uncontrolled resource consumption?
CVE-2026-24012 allows an attacker to exhaust system resources by sending queries with extreme time spans and minimal aggregation intervals.
What are the potential impacts of CVE-2026-24012?
The primary impact of CVE-2026-24012 is denial of service, which can make the system unresponsive.
How can I mitigate CVE-2026-24012?
To mitigate CVE-2026-24012, impose limits on the time range and aggregation intervals of queries made to Apache IoTDB.
Is Apache IoTDB affected by CVE-2026-24012?
Yes, CVE-2026-24012 directly affects Apache IoTDB due to its lack of limits on query parameters.