CVE-2022-43766 Apache IoTDB prior to 0.13.3 allows DoS
Attackers can cause denial of service in Apache IoTDB by submitting malicious regular expressions, requiring an upgrade or Java version change.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43766?
CVE-2022-43766 is a high-severity denial of service vulnerability in Apache IoTDB, published on 26 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to avoid it.
Weakness: CWE-400
Which versions are affected by CVE-2022-43766?
9 open source packages ship an affected version, including apache-iotdb, org.apache.iotdb:flink-tsfile-connector and org.apache.iotdb:iotdb-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-iotdb PyPI | From 0.12.2 | 0.13.3 |
apache-iotdb PyPI | From 0.12.2 | 0.13.3 |
apache-iotdb PyPI | From 0.12.2 | 0.13.3 |
org.apache.iotdb:flink-tsfile-connector Maven | From 0.12.2 | 0.13.3 |
org.apache.iotdb:flink-tsfile-connector Maven | From 0.12.2 | 0.13.3 |
org.apache.iotdb:iotdb-server Maven | From 0.12.2 | 0.13.3 |
3 more packages
org.apache.iotdb:iotdb-server Maven | From 0.12.2 | 0.13.3 |
org.apache.iotdb:tsfile Maven | From 0.12.2 | 0.13.3 |
org.apache.iotdb:tsfile Maven | From 0.12.2 | 0.13.3 |
Products include Apache Iotdb.
How do I fix CVE-2022-43766?
Upgrade apache-iotdb to 0.13.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-43766 being exploited?
There is no known exploitation of CVE-2022-43766 in the wild and no public exploit code.
Other vulnerabilities in Apache IoTDB
- CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
- CVE-2026-24015 Apache IoTDB: Insecure Default Configuration Vulnerability
- CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability
- CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
- CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF
Sources
Also known as GHSA-g6hg-4v3c-6jq7, PYSEC-2022-42972.