CVE-2026-40006: Apache IoTDB Unauthenticated Memory Exhaustion Denial of Service

Technical summary

This vulnerability chains three weaknesses: missing authentication on a network service, unchecked resource allocation, and unbounded memory requests. When pipe_air_gap_receiver_enabled is set to true, the AirGap receiver binds to TCP port 9780 without requiring credentials. The readLength() method reads a 32-bit signed integer directly from an unauthenticated socket connection, and readData() immediately uses this value as the size parameter in a new byte[length] allocation. Because there is no upper-bound validation, an attacker can specify a length up to 2,147,483,647 bytes (the maximum positive value for a 32-bit signed integer). The JVM will attempt to allocate this massive contiguous heap memory block per connection, and multiple connections amplify the effect. This rapidly exhausts heap space, triggering OutOfMemoryError conditions that crash or severely degrade the DataNode process.

Business impact

For organizations deploying Apache IoTDB with the AirGap pipe receiver enabled, this vulnerability creates a trivial, unauthenticated denial-of-service condition. An attacker with network access to port 9780 can disable time-series data collection and processing capabilities by crashing DataNode instances. In production environments using IoTDB for metrics, telemetry, or sensor data aggregation, this downtime disrupts data pipelines, alerting systems, and dependent applications. There is no data breach risk, but availability impact is severe and can be triggered by any external network actor without specialized tools or credentials.

Affected systems

Apache IoTDB versions 1.0.0 through 2.0.9 are vulnerable when the AirGap pipe receiver feature is explicitly enabled via configuration (pipe_air_gap_receiver_enabled=true). The feature is not enabled by default, so deployments running standard configurations are not at risk. Environments that have specifically activated AirGap receiver for inter-node replication or disaster recovery scenarios are directly exposed. Any DataNode instance with this setting enabled and network access to port 9780 can be attacked.

Exploitability

This vulnerability has very low barriers to exploitation. No authentication is required, the attack vector is network-based, and no user interaction is needed. An attacker needs only the ability to establish a TCP connection to port 9780 and send a crafted packet containing a large 32-bit integer. Exploitation requires no specialized tools, knowledge of IoTDB internals, or valid credentials. The attack is reliable and consistently causes memory exhaustion. The main limiting factor is that the feature must be explicitly enabled; defenders using default configurations are protected by that configuration choice alone.

Remediation

Immediate remediation requires upgrading to Apache IoTDB version 2.0.10 or later, which implements proper bounds checking on memory allocation requests. Organizations unable to patch immediately should disable the AirGap pipe receiver feature by setting pipe_air_gap_receiver_enabled=false in their configuration. If the feature is operationally necessary, network segmentation is critical: restrict access to port 9780 to only trusted internal hosts using firewall rules or network ACLs. Monitor for multiple rapid connection attempts or failed allocation patterns on that port. Verify patch application in your change management process before re-enabling the feature.

Patch guidance

Apply Apache IoTDB version 2.0.10 or any subsequent release after validating compatibility with your deployment. Review the Apache IoTDB release notes for version 2.0.10 to confirm the fix and identify any related changes that affect your configuration or operational procedures. Test the patched version in a non-production environment first, particularly if you rely on the AirGap receiver for active replication scenarios. After patching, re-enable pipe_air_gap_receiver_enabled if it was previously disabled, and verify the feature functions correctly before resuming normal operations. Confirm that memory allocation requests on port 9780 are now properly bounded.

Detection guidance

Monitor for connections to port 9780 from unexpected sources, particularly external or untrusted networks. Log and alert on any connection attempts when pipe_air_gap_receiver_enabled is true. Watch for rapid spikes in memory consumption or repeated OutOfMemoryError exceptions in DataNode logs shortly after unexpected network connections to that port. Implement network-based detection for packets attempting to write abnormally large integer values on that port. Check your JVM heap usage metrics and correlate sudden drops (crashes) with port 9780 connection logs. If you have not explicitly enabled AirGap receiver, verify your configuration file to confirm the setting is false or absent, then scan for any unauthorized configuration changes.

Why prioritize this

Although this vulnerability requires explicit configuration to be enabled and affects availability rather than confidentiality or integrity, it scores HIGH (7.5) because it allows unauthenticated network attackers to reliably crash critical infrastructure with no preconditions. For organizations that have intentionally enabled AirGap receiver—particularly in production environments—this should be treated as urgent. Even organizations running default configurations should verify they haven't accidentally enabled this feature and prioritize patching if they discover it is active.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an unauthenticated network attack (AV:N, PR:N) with low complexity (AC:L) that requires no user interaction (UI:N) and impacts only availability (C:N, I:N, A:H). The severity is driven by the complete lack of authentication, the ease of exploitation, and the direct ability to crash a critical service. The score does not reach CRITICAL (9.0+) because there is no confidentiality or integrity impact, and the feature is not enabled by default, reducing the scope of affected systems.

Frequently asked questions