Veille CVE

Recherche « Apache Software Foundation Apache IoTDB »

5 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 4 Exploitées (KEV) Tri : plus récentes « Apache Software Foundation Apache IoTDB » ✕
  1. CVE-2026-59562 – Non évaluée

    Apache Software Foundation Apache IoTDB

    Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

  2. CVE-2026-59229 – Non évaluée

    Apache Software Foundation Apache IoTDB

    The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A user with only SYSTEM-level privileges (such as USE_PIPE or MAINTAIN) who does NOT have WRITE_DATA or DELETE_DATA permissions on target databases can send specially crafted PipeData messages through the Legacy Pipe API, resulting in data loading/deletion operations executed as root — effectively bypassing IoTDB's permission model entirely. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

  3. CVE-2026-58663 – Non évaluée

    Apache Software Foundation Apache IoTDB

    An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

  4. CVE-2026-41114 – Non évaluée

    Apache Software Foundation Apache IoTDB JDBC driver

    Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users are recommended to upgrade to version 2.0.11, which fixes the issue.

  5. CVE-2026-44630 7.5 Élevée

    Apache Software Foundation Apache IoTDB

    Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError. This issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9. Users are recommended to upgrade to version 2.0.10, which fixes the issue.