Apache Iotdb
Apache · 25 CVEs
Apache IoTDB: RPC service denial of service via unchecked Thrift string length
Aug 10, 2026
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users
Jul 10, 2026
Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor
Jul 10, 2026
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
Jul 10, 2026
Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connec…
Jul 10, 2026
Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
Jul 10, 2026
Apache IoTDB: Path Traversal in Pipe File Transfer Receiver
Jul 10, 2026
Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
Jul 10, 2026
Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC
Jul 6, 2026
Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query
Jul 6, 2026
Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
Jul 6, 2026
Apache IoTDB: Path Traversal Vulnerability
Jun 26, 2026
Apache IoTDB: Path Traversal Vulnerability
Jun 26, 2026
Apache IoTDB: JEXL Expression Injection Vulnerability
Mar 9, 2026
Apache IoTDB: Insecure Default Configuration Vulnerability
Mar 9, 2026
Apache IoTDB: DoS Vulnerability
Sep 24, 2025
Apache IoTDB: Deserialization of untrusted Data
Sep 24, 2025
Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication
May 14, 2025
Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
May 14, 2025
Apache IoTDB: Remote Code Execution (RCE) risk via the UDF
Jan 15, 2024
Apache IoTDB: Unsafe deserialize map in Sync Tool
Dec 21, 2023
Apache IoTDB grafana-connector Login Bypass Vulnerability
Apr 17, 2023
Apache IoTDB prior to 0.13.3 allows DoS
Oct 26, 2022
No authorization of DatabaseConnectController in grafana-connector.
Sep 5, 2022
Login check vulnerability by session Id
Sep 5, 2022
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-44630 | Apache IoTDB: RPC service denial of service via unchecked Thrift string length | HIGH | 0.59% | Aug 10, 2026 |
| CVE-2026-40452 | Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users | HIGH | 0.43% | Jul 10, 2026 |
| CVE-2026-40009 | Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor | MEDIUM | 0.35% | Jul 10, 2026 |
| CVE-2026-40008 | Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC | CRITICAL | 0.60% | Jul 10, 2026 |
| CVE-2026-40007 | Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError | HIGH | 0.49% | Jul 10, 2026 |
| CVE-2026-40006 | Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver | HIGH | 0.58% | Jul 10, 2026 |
| CVE-2026-40005 | Apache IoTDB: Path Traversal in Pipe File Transfer Receiver | CRITICAL | 0.54% | Jul 10, 2026 |
| CVE-2026-28564 | Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials | CRITICAL | 0.68% | Jul 10, 2026 |
| CVE-2026-24013 | Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC | CRITICAL | 0.64% | Jul 6, 2026 |
| CVE-2026-24012 | Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query | HIGH | 0.74% | Jul 6, 2026 |
| CVE-2026-24014 | Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write | CRITICAL | 0.69% | Jul 6, 2026 |
| CVE-2025-64152 | Apache IoTDB: Path Traversal Vulnerability | CRITICAL | 0.54% | Jun 26, 2026 |
| CVE-2025-55017 | Apache IoTDB: Path Traversal Vulnerability | CRITICAL | 0.54% | Jun 26, 2026 |
| CVE-2026-24713 | Apache IoTDB: JEXL Expression Injection Vulnerability | CRITICAL | 0.66% | Mar 9, 2026 |
| CVE-2026-24015 | Apache IoTDB: Insecure Default Configuration Vulnerability | CRITICAL | 0.58% | Mar 9, 2026 |
| CVE-2025-48392 | Apache IoTDB: DoS Vulnerability | MEDIUM | 0.60% | Sep 24, 2025 |
| CVE-2025-48459 | Apache IoTDB: Deserialization of untrusted Data | CRITICAL | 0.49% | Sep 24, 2025 |
| CVE-2025-26864 | Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication | MEDIUM | 0.72% | May 14, 2025 |
| CVE-2024-24780 | Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function | CRITICAL | 1.35% | May 14, 2025 |
| CVE-2023-46226 | Apache IoTDB: Remote Code Execution (RCE) risk via the UDF | HIGH | 1.92% | Jan 15, 2024 |
| CVE-2023-51656 | Apache IoTDB: Unsafe deserialize map in Sync Tool | CRITICAL | 1.03% | Dec 21, 2023 |
| CVE-2023-24831 | Apache IoTDB grafana-connector Login Bypass Vulnerability | CRITICAL | 1.22% | Apr 17, 2023 |
| CVE-2022-43766 | Apache IoTDB prior to 0.13.3 allows DoS | HIGH | 1.46% | Oct 26, 2022 |
| CVE-2022-38370 | No authorization of DatabaseConnectController in grafana-connector. | HIGH | 1.35% | Sep 5, 2022 |
| CVE-2022-38369 | Login check vulnerability by session Id | MEDIUM | 1.27% | Sep 5, 2022 |
Showing 1 to 25 of 25 CVEs