CVE-2026-40007: apache software foundation apache iotdb Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-40007 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in apache software foundation apache iotdb. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.6% of scored vulnerabilities.

Timeline

1. 10-07-2026
   PublishedVulnerability first disclosed.
2. 10-07-2026
   Last modifiedVulnerability information updated.

Description

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.