{"id":"CVE-2026-24012","aliases":["PYSEC-2026-2079"],"title":"Uncontrolled Resource Consumption vulnerability in Apache IoTDB. ","summary":"Uncontrolled Resource Consumption vulnerability in Apache IoTDB. \n\nSome interface fails to impose reasonable\nlimits on the time span and aggregation interval of the query. An attacker\ncan construct a request with extreme parameters (e.g.…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"apache-iotdb","product":"apache-iotdb","ecosystem":"pip","affected":["apache-iotdb >= 1.3.3, < 2.0.8"],"patched":["apache-iotdb 2.0.8"],"published":"2026-07-06","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/PYSEC-2026-2079","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/07/06/10"},{"url":"https://lists.apache.org/thread/0g5th1t2vj6j8hm5t9w3xh9n6f6ht9z8"}],"tags":["osv","pip"],"epss":0.0074,"epssPercentile":0.53144,"ingestedAt":"2026-07-09T18:56:35.380Z","slug":"CVE-2026-24012","body":"## Overview\n\nUncontrolled Resource Consumption vulnerability in Apache IoTDB. \n\nSome interface fails to impose reasonable\nlimits on the time span and aggregation interval of the query. An attacker\ncan construct a request with extreme parameters (e.g., a very large time\nrange combined with a minimal interval). This forces the DataNode to build\nan enormous result set in memory, which exhausts the Java heap and causes\nthe DataNode process to crash.\n\nThis issue affects Apache IoTDB: from 1.3.3 before 2.0.8.\n\nUsers are recommended to upgrade to version 2.0.8, which fixes the issue.\n\n## Affected packages\n\n- `apache-iotdb >= 1.3.3, < 2.0.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `apache-iotdb 2.0.8`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}