CVE-2026-24012 - Vulnerability Details - OpenCVE

Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8

History

Mon, 06 Jul 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Title		Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query
Weaknesses		CWE-400
References		https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-07-06T08:38:25.308Z

Updated: 2026-07-06T08:38:25.308Z

Reserved: 2026-01-20T02:30:29.932Z

Link: CVE-2026-24012

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24012", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-20T02:30:29.932Z", "datePublished": "2026-07-06T08:38:25.308Z", "dateUpdated": "2026-07-06T08:38:25.308Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache IoTDB", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.0.8", "status": "affected", "version": "1.3.3", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Yan Nan (Detecon Security Lab)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Uncontrolled Resource Consumption vulnerability in Apache IoTDB. </p><p>Some interface<span style=\"background-color: rgb(255, 255, 255);\"> fails to impose reasonable</span><span style=\"background-color: rgb(255, 255, 255);\">\nlimits on the time span and aggregation interval of the query. </span><span style=\"background-color: rgb(255, 255, 255);\">An attacker</span><span style=\"background-color: rgb(255, 255, 255);\">\ncan construct a request with extreme parameters (e.g., a very large time</span><span style=\"background-color: rgb(255, 255, 255);\">\nrange combined with a minimal interval). </span><span style=\"background-color: rgb(255, 255, 255);\">This forces the DataNode to build</span><span style=\"background-color: rgb(255, 255, 255);\">\nan enormous result set in memory, which exhausts the Java heap and causes</span><span style=\"background-color: rgb(255, 255, 255);\">\nthe DataNode process to crash.</span></p><p>This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.</p><p>Users are recommended to upgrade to version 2.0.8, which fixes the issue.</p>"}], "value": "Uncontrolled Resource Consumption vulnerability in Apache IoTDB.\u00a0\n\nSome interface\u00a0fails to impose reasonable\nlimits on the time span and aggregation interval of the query.\u00a0An attacker\ncan construct a request with extreme parameters (e.g., a very large time\nrange combined with a minimal interval).\u00a0This forces the DataNode to build\nan enormous result set in memory, which exhausts the Java heap and causes\nthe DataNode process to crash.\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-06T08:38:25.308Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}