Iotdb (Apache) - vulnerabilities (CVEs)

21 CVEs, 0 in the last 30 days, 53 known versions, newest CVE from 2026-07-06. Vendor: Apache.

CVEs of Iotdb

CVE-2026-24013 - CVSS 9.1 (critical), 2026-07-06: Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers lack strict validation of the sessionId parameter. An…
CVE-2026-24012 - CVSS 7.5 (high), 2026-07-06: Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose reasonable limits on the time span and aggregation interval…
CVE-2026-24014 - CVSS 9.8 (critical), 2026-07-06: Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient…
CVE-2026-24713 - CVSS 9.8 (critical), 2026-03-09: Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are…
CVE-2026-24015 - CVSS 9.8 (critical), 2026-03-09: A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to…
CVE-2025-48459 - CVSS 5.3 (medium), 2025-09-24: Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to…
CVE-2025-48392 - CVSS 7.5 (high), 2025-09-24: A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to…
CVE-2025-26864 - CVSS 7.5 (high), 2025-05-14: Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache…
CVE-2025-26795 - CVSS 7.5 (high), 2025-05-14: Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This…
CVE-2024-24780 - CVSS 9.8 (critical), 2025-05-14: Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function…
CVE-2023-46226 - CVSS 9.8 (critical), 2024-01-15: Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version…
CVE-2023-51656 - CVSS 9.8 (critical), 2023-12-21: Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade…
CVE-2023-30771 - CVSS 9.8 (critical), 2023-04-17: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3.…
CVE-2023-24831 - CVSS 9.8 (critical), 2023-04-17: Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through…
CVE-2023-24829 - CVSS 8.8 (high), 2023-01-31: Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before…
CVE-2023-24830 - CVSS 7.5 (high), 2023-01-30: Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3.
CVE-2022-43766 - CVSS 7.5 (high), 2022-10-26: Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with…
CVE-2022-38369 - CVSS 8.8 (high), 2022-09-05: Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
CVE-2022-38370 - CVSS 7.5 (high), 2022-09-05: Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should…
CVE-2020-25649 - CVSS 7.5 (high), 2020-12-03: A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity…
CVE-2020-1952 - CVSS 9.8 (critical), 2020-04-27: An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients…