Vulnerability PYSEC-2026-2079
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 months ago
July 06, 2026 at 09:16 AM UTC
No summary available
1.3.3 - 2.0.6
1.3.3 - 2.0.6
Details
Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and causes the DataNode process to crash.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
4 months ago
No summary available
1.3.3 - 2.0.6 PYSEC-2026-2080
1.3.3 - 2.0.6 PYSEC-2026-2080
Critical
4 months ago
No summary available
1.3.3 - 2.0.6 PYSEC-2026-2081
1.3.3 - 2.0.6 PYSEC-2026-2081
Medium Risk
1 year ago
Apache IoTDB: Deserialization of untrusted Data
1.0.0 - 2.0.4 GHSA-776q-jw43-fhjx
1.0.0 - 2.0.4 GHSA-776q-jw43-fhjx
Medium Risk
1 year ago
No summary available
1.0.0 - 2.0.4 PYSEC-2025-88
1.0.0 - 2.0.4 PYSEC-2025-88
Medium Risk
1 year ago
Apache IoTDB Discloses Sensitive Information via Log Files
0.10.0 - 1.3.3 and 2.0.1b0 GHSA-5fc3-pqf2-57cx
0.10.0 - 1.3.3 and 2.0.1b0 GHSA-5fc3-pqf2-57cx
Impacted packages
Timeline
Published
4 months ago
July 06, 2026 at 09:16 AM UTC
Fixed (2.0.8)
6 months ago
April 14, 2026 at 01:52 AM UTC
Last Modified
3 months ago
July 08, 2026 at 11:30 AM UTC