CVE-2026-40006

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB.<br /> When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver<br /> accepts raw TCP connections on port 9780 with no authentication. The<br /> readLength method reads an attacker-controlled 32-bit integer from the<br /> socket and readData passes it directly to new byte[length] with no<br /> upper-bound check. An unauthenticated attacker can cause the JVM to attempt<br /> an allocation of up to 2,147,483,647 bytes per connection, exhausting heap<br /> memory and crashing or severely degrading the DataNode process.<br /> <br /> <br /> This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.<br /> <br /> Users are recommended to upgrade to version 2.0.10, which fixes the issue.