CVE-2026-40006 Details
Description
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
A vulnerability in Apache IoTDB AirGap pipe receiver allows for unauthenticated heap-exhaustion denial-of-service. When the pipe_air_gap_receiver_enabled setting is true, the receiver accepts raw TCP connections on port 9780 without authentication. The vulnerability arises because the readLength method can be manipulated to read a 32-bit integer controlled by an attacker. This length value is then used to allocate memory without any upper limit, potentially allowing the allocation of up to 2,147,483,647 bytes per connection. This unbounded allocation can exhaust the Java Virtual Machine's heap memory, leading to a crash or significant degradation of the DataNode process. This issue affects Apache IoTDB versions from 1.0.0 prior to 2.0.10.
Users are advised to upgrade to Apache IoTDB version 2.0.10 or later, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/10/3 | CVE | |
| https://lists.apache.org/thread/rfpt7m9fvdrw37r3ow5omp2n914z6zqk | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache IoTDB | >= 1.0.0, < 2.0.10 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | CVE Modified | CVE |
| Jul 10, 2026 | New CVE Received | [email protected] |