SB20260824129 - Multiple vulnerabilities in Apache IoTDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824129

SB20260824129 - Multiple vulnerabilities in Apache IoTDB

Published: August 24, 2026

Security Bulletin ID SB20260824129
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-24012)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in aggregation query interface when processing queries with extreme time span and aggregation interval parameters. A remote attacker can send a specially crafted query to cause a denial of service.

The issue can exhaust the Java heap and crash the DataNode process.


2) Improper Authentication (CVE-ID: CVE-2026-24013)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper authentication in Thrift RPC query handlers when handling requests with a forged sessionId parameter. A remote attacker can send a specially crafted request to disclose sensitive information.

The issue allows access to valid query results without performing openSession authentication.


3) Path traversal (CVE-ID: CVE-2026-24014)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write arbitrary files.

The vulnerability exists due to path traversal in DataNode internal RPC interface for creating Trigger instances when processing an uploaded Trigger JAR name. A remote attacker can supply a JAR name containing path traversal sequences to write arbitrary files.

Exploitation requires the internal DataNode RPC port to be exposed to an untrusted network.


Remediation

Install update from vendor's website.

References