CVE-2026-24012Disclosure(apache / iotdb)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

iotdb

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-06); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

apache

Products

iotdb

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-06	2	Disclosure2
2026-07-08	1	General1

Full discourse3 posts

Open Source Security mailing list@oss_security90d
General
Apache IoTDB CVE-2026-24012: DoS via Resource Exhaustion in Aggregation Query https://www.openwall.com/lists/oss-security/2026/07/06/10 CVE-2026-24013: Authentication Bypass via Forged SessionID in Thrift RPC https://www.openwall.com/lists/oss-security/2026/07/06/11 CVE-2026-24014: Path Traversal [...] Arbitrary File Write https://www.openwall.com/lists/oss-security/2026/07/06/12
Post summary
The text presents a brief announcement of three CVEs for Apache IoTDB, providing only the vulnerability types without exploit code, patches, or active exploitation details.
00040578
4.7K followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-24012 Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the q… https://www.cve.org/CVERecord?id=CVE-2026-24012
Post summary
The tweet announces CVE-2026-24012, detailing an uncontrolled resource consumption flaw in Apache IoTDB caused by missing limits on query time span and aggregation interval.
00010721
57.7K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-24012 Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval of the q… https://www.cve.org/CVERecord?id=CVE-2026-24012 ----- Traducción: CVE-2026-24012 Vul… http://infoflow.cloud`
Post summary
The post discloses CVE-2026-24012, an uncontrolled resource consumption flaw in Apache IoTDB, describing how an interface lacks proper limits. No exploits, patches, or ongoing attacks are mentioned.
0000042
92 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	iotdb	-	-	-

Explore more

Back to dashboard apache CVEs iotdb vulnerabilities