CVE-2026-40007: Apache IoTDB AirGap Receiver Denial of Service via Uncontrolled Recursion

Technical summary

CVE-2026-40007 is an uncontrolled recursion vulnerability in Apache IoTDB's pipe_air_gap_receiver module. The readLength method in the AirGap receiver processes socket input and recursively invokes itself when it encounters an E-language prefix marker, with no depth limit enforced. An unauthenticated attacker can construct a stream of repeated E-language prefix tokens, causing the call stack to grow without bound until a StackOverflowError terminates the receiver thread. The vulnerability is rooted in missing input validation and absence of recursion depth limits (CWE-674, CWE-400).

Business impact

Exploitation results in immediate denial of service to the IoTDB instance. Any time-series data ingestion or querying through the affected AirGap receiver becomes unavailable until the service is manually restarted. In production environments where IoTDB handles real-time sensor or device data collection, a successful attack interrupts data pipeline operations and may lead to loss of data points, alerting delays, and downstream application failures that depend on continuous time-series availability.

Affected systems

Apache IoTDB versions 1.0.0 through 2.0.9 are affected. The vulnerability only manifests when the AirGap receiver feature is explicitly enabled via the pipe_air_gap_receiver_enabled configuration setting. Deployments with this feature disabled are not vulnerable. Organizations should verify their IoTDB configuration to determine exposure.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, has low attack complexity, and needs only network access to the IoTDB service. An attacker can craft a simple exploit in minutes—repeating a known token pattern and sending it over the network socket. No special tools or privileges are needed. The attack surface is broad for any IoTDB instance with AirGap receiver enabled and exposed to untrusted networks.

Remediation

Upgrade Apache IoTDB to version 2.0.10 or later, which contains the fix. Before patching, consider disabling the pipe_air_gap_receiver_enabled configuration option if it is not actively used in your environment. If AirGap receiver must remain enabled, restrict network access to the IoTDB service using firewalls or network segmentation to permit only trusted clients.

Patch guidance

Verify against the vendor advisory and release notes that Apache IoTDB 2.0.10 addresses CVE-2026-40007 and contains the recursion depth limit fix. Test the upgrade in a non-production environment first to ensure compatibility with your data models and connected applications. After deploying the patch, confirm that the pipe_air_gap_receiver_enabled setting is appropriately configured and that AirGap receiver functionality works as expected.

Detection guidance

Monitor IoTDB service logs and JVM errors for sudden StackOverflowError exceptions in the receiver thread, particularly if they occur shortly after an increase in network traffic to the IoTDB port. Implement network-level monitoring to detect patterns of repeated or unusual socket data being sent to the service. Establish baseline metrics for normal recursion depth and thread stack usage, then alert on anomalies. Consider deploying an IDS/IPS signature that identifies repeated E-language prefix sequences in traffic destined for IoTDB.

Why prioritize this

With a CVSS v3.1 score of 7.5 (HIGH), unauthenticated network accessibility, and trivial exploit complexity, this vulnerability poses significant operational risk to affected deployments. While no data breach or code execution is possible, continuous availability is compromised. Organizations running IoTDB in production—especially those collecting time-critical sensor or device data—should treat this as a high-priority patch. The ease of exploitation and immediate service impact justify rapid remediation.

Risk score, explained

The score of 7.5 reflects a HIGH-severity denial-of-service attack that is remotely triggerable without authentication (AV:N, PR:N) and requires no special user interaction (UI:N). Attack complexity is low (AC:L), and the impact is high availability disruption (A:H). No confidentiality or integrity violation occurs (C:N, I:N), limiting the score. The threat is bounded to availability but is nearly certain to succeed if the precondition (AirGap receiver enabled) is met.

Frequently asked questions