CVE-2026-24012: Apache IoTDB Denial of Service via Uncontrolled Query Resource Consumption

Technical summary

The vulnerability stems from insufficient input validation on query time span and aggregation interval parameters in Apache IoTDB's query interface. The affected query processing code fails to enforce reasonable bounds on these values, permitting an attacker to craft requests designed to generate extremely large intermediate result sets. During query execution, the DataNode attempts to construct and hold this oversized result set entirely in memory, triggering an out-of-memory condition that crashes the Java process. This uncontrolled resource consumption is categorized under CWE-400 and poses a network-accessible denial-of-service vector.

Business impact

A successful attack disrupts time-series data collection, monitoring, and analytics operations dependent on the affected IoTDB cluster. DataNode crashes interrupt query processing and potentially impact data write operations, degrading observability and alerting systems. For organizations using IoTDB to collect IoT telemetry, sensor data, or metrics, even brief availability loss can cause visibility gaps during critical operational windows. Repeated attacks could enforce a sustained denial-of-service condition, reducing the reliability of monitoring infrastructure.

Affected systems

Apache IoTDB versions 1.3.3 through 2.0.7 are vulnerable. The issue does not affect versions prior to 1.3.3 or version 2.0.8 and later. This affects deployments across all supported platforms where IoTDB is installed, particularly those exposing query endpoints to untrusted networks or multi-tenant environments.

Exploitability

Exploitability is high. The attack requires no authentication, no special privileges, and no user interaction. An attacker with network access to the IoTDB query interface can immediately craft and send a malicious query. The network vector (AV:N), low attack complexity (AC:L), and lack of privilege or interaction requirements mean this can be weaponized with minimal effort once the affected interface is discovered. The CVSS 3.1 score of 7.5 (HIGH) reflects the ease of exploitation, though impact is limited to availability rather than confidentiality or integrity.

Remediation

Upgrade to Apache IoTDB version 2.0.8 or later to obtain the fix. For organizations unable to immediately patch, consider network-level mitigations: restrict query interface access to trusted clients using firewall rules, reverse proxy authentication, or IP allowlisting. Monitor DataNode process exit events and Java heap usage for signs of exploitation. Implement query timeouts and connection limits at the application level where possible, though these are not guaranteed protections absent the vendor patch.

Patch guidance

Apply the upgrade to Apache IoTDB 2.0.8 according to your deployment model. Verify compatibility with any custom extensions or integrations before rolling out. Test the upgrade in a non-production environment to confirm query functionality and performance remain stable. Plan upgrades during maintenance windows to minimize disruption to time-series collection. Verify the upgrade by confirming the version string and reviewing release notes to ensure the fix has been included.

Detection guidance

Monitor DataNode logs for repeated out-of-memory exceptions (OutOfMemoryError) or unexpected process terminations correlated with incoming queries. Track query parameters in access logs to identify requests with unusually large time ranges or minimal aggregation intervals—legitimate queries rarely span years with sub-second intervals. Observe Java heap memory usage patterns for sudden spikes preceding crashes. Set up alerting on DataNode exit codes and process restart frequency as indicators of potential attack patterns. Network-based detection can flag queries with pathological parameter combinations if you inspect query payloads at the application gateway level.

Why prioritize this

This vulnerability merits prompt remediation due to the combination of network accessibility, zero authentication requirement, and immediate availability impact. Although it does not lead to data breach or system compromise, the denial-of-service severity and ease of exploitation create a meaningful business risk, especially in environments where IoTDB serves as infrastructure for real-time monitoring or critical IoT data pipelines. The HIGH CVSS score and large version range (1.3.3–2.0.7) reflect its broad applicability.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by the unrestricted network vector (AV:N/AC:L/PR:N/UI:N), which permits any remote attacker to trigger the vulnerability without credentials. The impact is confined to availability (A:H) with no confidentiality or integrity breach, preventing a CRITICAL rating. The severity reflects a genuine operational threat—service unavailability—rather than data exposure, making it a priority for availability-critical deployments but lower than exploits enabling data exfiltration or system compromise.

Frequently asked questions