CVE-2026-40006: Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipeairgapreceiverenabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.10 - Configuration
Set pipe_air_gap_receiver_enabled=false so the AirGap pipe receiver does not accept unauthenticated raw TCP connections on port 9780.
Apache IoTDB AirGap pipe receiver pipe_air_gap_receiver_enabled = false - Compensating control
Restrict network access to Apache IoTDB port 9780 (used by the AirGap pipe receiver) at the firewall/ACL so only trusted sources can reach it, since connections are accepted with no authentication when pipe_air_gap_receiver_enabled=true.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40006?
The severity of CVE-2026-40006 is rated high with a CVSS score of 7.5.
How do I fix CVE-2026-40006?
To fix CVE-2026-40006, disable the pipe_air_gap_receiver feature or implement appropriate authentication mechanisms.
What types of attacks does CVE-2026-40006 expose systems to?
CVE-2026-40006 exposes systems to unauthenticated heap exhaustion denial-of-service attacks.
Which versions of Apache IoTDB are affected by CVE-2026-40006?
All versions of Apache IoTDB that have the pipe_air_gap_receiver feature enabled are potentially affected by CVE-2026-40006.
What is the main issue highlighted in CVE-2026-40006?
CVE-2026-40006 highlights a vulnerability related to unauthenticated access leading to unbounded memory allocation.