{"schemaVersion":3,"id":"CVE-2026-44630","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker can cause IoTDB to allocate an excessive amount of memory and crash with an OutOfMemoryError.\n\n\nThis issue affects Apache IoTDB: before 1.3.8, from 2.0.0 before 2.0.9.\n\nUsers are recommended to upgrade to version 2.0.10, which fixes the issue.","dates":{"published":"2026-08-10T09:25:11.899Z","modified":"2026-08-12T15:54:05.223Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0059,"percentile":0.47123,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0.175,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00415},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0059,"percentile":0.47123}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00415,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0059,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0059,"percentile":0.47123}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"},{"id":"CWE-789","name":"Memory Allocation with Excessive Size Value","description":"The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/789.html"}],"affected":[{"vendor":"apache software foundation","product":"apache iotdb","name":"Apache IoTDB","label":"apache iotdb","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.0.0, < 2.0.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.8 | ≥ 2.0.0, < 2.0.10","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_iotdb"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/tfsgd9whbq79lgjvdzj44hw0fhsofly8","label":"lists.apache.org/thread/tfsgd9whbq79lgjvdzj44hw0fhsofly8","hostname":"lists.apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/10/1","label":"www.openwall.com/lists/oss-security/2026/08/10/1","hostname":"www.openwall.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-08-10T09:25:11.899Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-12T15:54:05.223Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T04:41:06.618Z","stale":false,"partial":false}}