CVE-2026-40006

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-40006
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/rfpt7m9fvdrw37r3ow5omp2n914z6zqk
http://www.openwall.com/lists/oss-security/2026/07/10/3
Configurations

No configuration.

History

25 Oct 2026, 15:10

Type Values Removed Values Added
Summary
  • (es) Asignación de memoria con valor de tamaño excesivo, Asignación de recursos sin límites o limitación, vulnerabilidad de autenticación faltante para función crítica en Apache IoTDB. Cuando pipe_air_gap_receiver_enabled=true, el receptor de tubería AirGap de IoTDB acepta conexiones TCP sin procesar en el puerto 9780 sin autenticación. El método readLength lee un entero de 32 bits controlado por el atacante del socket y readData lo pasa directamente a new byte[length] sin verificación de límite superior. Un atacante no autenticado puede hacer que la JVM intente una asignación de hasta 2.147.483.647 bytes por conexión, agotando la memoria del montón y bloqueando o degradando gravemente el proceso DataNode. Este problema afecta a Apache IoTDB: desde 1.0.0 antes de 2.0.10. Se recomienda a los usuarios actualizar a la versión 2.0.10, que corrige el problema.
Information

Published : 2026-07-10 08:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-40006

Mitre link : CVE-2026-40006

CVE.ORG link : CVE-2026-40006

JSON object : View

Products Affected

No product.

CWE
CWE-306

Missing Authentication for Critical Function

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-789

Memory Allocation with Excessive Size Value