CVE-2026-40007: Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError
Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipeairgapreceiverenabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.10 - Configuration
Set pipe_air_gap_receiver_enabled=false to disable the IoTDB AirGap receiver feature that contains the E-language prefix parser recursion leading to per-connection StackOverflowError.
IoTDB AirGap receiver pipe_air_gap_receiver_enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40007?
CVE-2026-40007 has a severity rating of high, with a CVSS score of 7.5.
What is the risk associated with CVE-2026-40007?
CVE-2026-40007 has a risk rating of 46, indicating significant potential for exploitation.
How do I fix CVE-2026-40007?
To mitigate CVE-2026-40007, ensure that the configuration for pipe_air_gap_receiver_enabled is set to false.
What types of attacks can exploit CVE-2026-40007?
CVE-2026-40007 can be exploited through unauthenticated attacks leading to a StackOverflowError due to uncontrolled recursion.
Which software is impacted by CVE-2026-40007?
CVE-2026-40007 affects Apache IoTDB when the AirGap receiver feature is enabled.