CVE-2026-44630: Apache IoTDB: RPC service denial of service via unchecked Thrift string length
Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError.
This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDBto a version that resolves this vulnerability.Fixed in 2.0.10
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44630?
CVE-2026-44630 has a risk rating of 54, indicating a moderate severity level.
How do I fix CVE-2026-44630?
To fix CVE-2026-44630, update to the latest version of Apache IoTDB that includes patches addressing the unchecked Thrift string length.
What causes CVE-2026-44630?
CVE-2026-44630 is caused by improper validation of length fields in the RPC service of Apache IoTDB.
Who is affected by CVE-2026-44630?
CVE-2026-44630 affects users of the Apache IoTDB software configured to accept Thrift RPC calls.
What is the impact of CVE-2026-44630?
The impact of CVE-2026-44630 is a denial of service condition where an attacker can crash the IoTDB service by exhausting memory.