CVE-2026-40008

9.8 Critique

Publiée le 10/07/2026 à 10:16 · Modifiée le 10/07/2026 à 18:16 · Analyse NVD reportée · Source : security@apache.org

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache IoTDB

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-470

Références

https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng
http://www.openwall.com/lists/oss-security/2026/07/10/5

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories