CVE-2026-24012 Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query

High 7.5 Published 6 Jul 2026 Updated 6 Jul 2026

An attacker can crash the Apache IoTDB DataNode by sending aggregation queries with extreme parameters that exhaust memory resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-24012?

CVE-2026-24012 is a high-severity denial of service vulnerability in Apache IoTDB, published on 6 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.

Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Weakness: CWE-400

Which versions are affected by CVE-2026-24012?

1 open source package ship an affected version, including apache-iotdb. It affects 1 product.

Package	Affected	Fixed in
`apache-iotdb` PyPI	From `1.3.3`	`2.0.8`

Products include Apache Iotdb.

How do I fix CVE-2026-24012?

Upgrade apache-iotdb to 2.0.8 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-24012 being exploited?

There is no known exploitation of CVE-2026-24012 in the wild and no public exploit code.

Sources

Also known as GHSA-m38g-pffj-4hcr, PYSEC-2026-2079.