Apache Software Foundation Iotdb vulnerabilities

• apache software foundation iotdb Apache IoTDB: Legacy Pipe Privilege Escalation CVE-2026-59229 8.8 HighOctober 21, 2026
• apache software foundation iotdb Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC CVE-2026-59562 9.8 CriticalOctober 21, 2026
• apache software foundation iotdb jdbc driver Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver CVE-2026-41114 7.5 HighOctober 21, 2026
• apache software foundation iotdb Apache IoTDB: Auth Bypass in pipeTransfer() interface CVE-2026-58663 9.8 CriticalOctober 21, 2026
• apache software foundation iotdb Apache IoTDB: RPC service denial of service via unchecked Thrift string length CVE-2026-44630 7.5 HighAugust 10, 2026
• apache software foundation iotdb c++ client Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data CVE-2026-40454 7.5 HighJuly 10, 2026
• apache software foundation iotdb Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users CVE-2026-40452 7.5 HighJuly 10, 2026
• apache software foundation iotdb Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor CVE-2026-40009 6.5 MediumJuly 10, 2026
• apache software foundation iotdb Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC CVE-2026-40008 9.8 CriticalJuly 10, 2026
• apache software foundation iotdb Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError CVE-2026-40007 7.5 HighJuly 10, 2026
• apache software foundation iotdb Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver CVE-2026-40006 7.5 HighJuly 10, 2026
• apache software foundation iotdb Apache IoTDB: Path Traversal in Pipe File Transfer Receiver CVE-2026-40005 9.1 CriticalJuly 10, 2026
• apache software foundation iotdb Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials CVE-2026-28564 9.8 CriticalJuly 10, 2026
• apache iotdb Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC CVE-2026-24013 Fix available 9.1 CriticalJuly 6, 2026
• apache iotdb Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query CVE-2026-24012 Fix available 7.5 HighJuly 6, 2026
• apache iotdb Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write CVE-2026-24014 Fix available 9.8 CriticalJuly 6, 2026
• apache software foundation iotdb Apache IoTDB: Path Traversal Vulnerability CVE-2025-64152 Fix available 9.1 CriticalJune 26, 2026
• apache software foundation iotdb Apache IoTDB: Path Traversal Vulnerability CVE-2025-55017 Fix available 9.1 CriticalJune 26, 2026
• apache iotdb Apache IoTDB: JEXL Expression Injection Vulnerability CVE-2026-24713 Fix available 9.8 CriticalMarch 9, 2026
• apache iotdb Apache IoTDB: Insecure Default Configuration Vulnerability CVE-2026-24015 Fix available 9.8 CriticalMarch 9, 2026
• apache iotdb Apache IoTDB: DoS Vulnerability CVE-2025-48392 Fix available 7.5 HighSeptember 24, 2025
• apache iotdb Apache IoTDB: Deserialization of untrusted Data CVE-2025-48459 Fix available 5.3 MediumSeptember 24, 2025
• apache iotdb Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication CVE-2025-26864 Fix available 7.5 HighMay 14, 2025
• apache iotdb, apache software foundation iotdb jdbc driver +1 more Apache IoTDB JDBC driver: Exposure of Sensitive Information in IoTDB JDBC driver CVE-2025-26795 Fix available 7.5 HighMay 14, 2025
• apache iotdb Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function CVE-2024-24780 Fix available 9.8 CriticalMay 14, 2025
• apache iotdb workbench Apache IoTDB Workbench: SSRF Vulnerability (EOL) CVE-2024-36448 7.3 HighAugust 5, 2024
• apache iotdb Apache IoTDB: Remote Code Execution (RCE) risk via the UDF CVE-2023-46226 Fix available 9.8 CriticalJanuary 15, 2024
• apache iotdb Apache IoTDB: Unsafe deserialize map in Sync Tool CVE-2023-51656 Fix available 9.8 CriticalDecember 21, 2023
• apache iotdb, apache software foundation iotdb workbench, apache iotdb web workbench +2 more Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench CVE-2023-30771 9.8 CriticalApril 17, 2023
• apache iotdb Apache IoTDB grafana-connector Login Bypass Vulnerability CVE-2023-24831 Fix available 9.8 CriticalApril 17, 2023
• apache iotdb, apache software foundation iotdb workbench +1 more Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench CVE-2023-24829 Fix available 8.8 HighJanuary 31, 2023
• apache iotdb, apache software foundation iotdb workbench +1 more Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization CVE-2023-24830 Fix available 7.5 HighJanuary 30, 2023
• apache iotdb Apache IoTDB prior to 0.13.3 allows DoS CVE-2022-43766 Fix available 7.5 HighOctober 26, 2022
• apache iotdb No authorization of DatabaseConnectController in grafana-connector. CVE-2022-38370 Fix available 7.5 HighSeptember 5, 2022
• apache iotdb Login check vulnerability by session Id CVE-2022-38369 Fix available 8.8 HighSeptember 5, 2022