CVE-2026-40006 Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
Unauthenticated attackers can crash Apache IoTDB DataNodes by sending large size values to the AirGap pipe receiver, causing heap exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40006?
CVE-2026-40006 is a high-severity denial of service vulnerability in Apache IoTDB, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and readData passes it directly to new byte[length] with no upper-bound check. An unauthenticated attacker can cause the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing or severely degrading the DataNode process.
This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.
Users are recommended to upgrade to version 2.0.10, which fixes the issue.
Which versions are affected by CVE-2026-40006?
How do I fix CVE-2026-40006?
No fix has been published for CVE-2026-40006 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40006 being exploited?
There is no known exploitation of CVE-2026-40006 in the wild and no public exploit code.
Sources
Also known as GHSA-qx9j-cv9x-384r.