CVE-2026-40006

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.0.0 through 2.0.9

Description An issue exists in the IoTDB AirGap pipe receiver when the pipe air gap receiver enabled variable is set to true. The receiver accepts raw TCP connections on port 9780 without authentication. The readLength() function reads a 32-bit integer from the socket, which is then passed to readData() and used to allocate a byte array new byte[length] without an upper-bound check. An unauthenticated attacker can provide a large value, forcing the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, leading to heap memory exhaustion and causing the DataNode process to crash or severely degrade.

Recommendations Upgrade to version 2.0.10. As a temporary mitigation, set the pipe air gap receiver enabled variable to false to disable the vulnerable receiver.