CVE-2026-24816: Datavane TIS Infinite Loop DoS Vulnerability

CVE-2026-24816 Overview

CVE-2026-24816 is an infinite loop vulnerability in Datavane TIS, an open-source data integration platform. The flaw resides in the ChangeDomainAction.java file within the tis-console/src/main/java/com/qlangtech/tis/runtime/module/action modules. The vulnerability is classified under CWE-835, Loop with Unreachable Exit Condition. It affects all versions of TIS prior to v4.3.0. Remote unauthenticated attackers can trigger the condition over the network without user interaction.

Critical Impact
A network-reachable attacker can trigger an unbounded loop in the TIS console, exhausting CPU resources and rendering the data integration platform unavailable.

Affected Products

Datavane TIS versions prior to v4.3.0
tis-console module containing ChangeDomainAction.java
Deployments exposing the TIS runtime action endpoints to untrusted networks

Discovery Timeline

2026-01-27 - CVE-2026-24816 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-24816

Vulnerability Analysis

The vulnerability stems from a loop construct in ChangeDomainAction.java whose exit condition cannot be reached under attacker-influenced input. When the action handler processes a crafted request, control flow enters a loop that never terminates. The processing thread consumes CPU cycles indefinitely. Repeated requests exhaust available worker threads in the TIS console, denying service to legitimate users.

The CVSS 4.0 vector indicates the attack is network-reachable, requires no privileges, and requires no user interaction. The vulnerable code path is reachable through the runtime module action interface exposed by the TIS console. The associated EPSS score is 0.063%, indicating low observed exploitation activity to date.

Root Cause

The root cause is improper validation of loop termination conditions in the ChangeDomainAction handler. Input values supplied to the action can place the loop variable into a state where the termination predicate never evaluates to true. The upstream fix is tracked in the Datavane TIS Pull Request #444, which corrects the loop bounds and adds guard conditions to ensure forward progress.

Attack Vector

An attacker submits a crafted HTTP request to the TIS console targeting the ChangeDomainAction endpoint. No authentication is required. The handler enters the unbounded loop and pins a worker thread. Repeating the request across multiple connections exhausts the application's thread pool and CPU. The TIS console becomes unresponsive to administrative and integration traffic.

No verified public proof-of-concept code is available. Refer to the upstream pull request for the patched control flow.

Detection Methods for CVE-2026-24816

Indicators of Compromise

Sustained CPU saturation on hosts running the TIS console with no corresponding batch workload
Worker threads in the TIS JVM stuck inside com.qlangtech.tis.runtime.module.action.ChangeDomainAction frames
HTTP access logs showing repeated requests to the ChangeDomain action endpoint from a single source
TIS console becoming unresponsive to health checks while the JVM process remains alive

Detection Strategies

Capture periodic JVM thread dumps and alert when multiple threads remain in ChangeDomainAction across consecutive samples
Rate-limit or alert on repeated requests to TIS runtime action URLs from non-administrative sources
Monitor TIS console response latency and 5xx error rates as early signals of resource exhaustion

Monitoring Recommendations

Forward TIS console access logs and JVM metrics to a centralized log platform for correlation
Establish a baseline for normal request rates against the tis-console action endpoints
Alert on sustained CPU usage above baseline for the TIS process for more than five minutes

How to Mitigate CVE-2026-24816

Immediate Actions Required

Upgrade Datavane TIS to version 4.3.0 or later, which contains the fix from PR #444
Restrict network access to the TIS console so that only trusted administrative networks can reach the runtime action endpoints
Place the TIS console behind an authenticating reverse proxy if direct exposure is required

Patch Information

The fix is merged in the Datavane TIS repository through Pull Request #444 and is included in TIS v4.3.0. The patch corrects the loop termination logic in ChangeDomainAction.java so that the exit condition is guaranteed to be reached for all valid and invalid inputs.

Workarounds

Block external access to the ChangeDomain action path at the reverse proxy or web application firewall layer
Apply per-source request rate limits to the TIS console to slow exploitation of unpatched instances
Configure JVM thread pool limits and request timeouts to bound the damage from any single stuck request

bash

# Example nginx rule to restrict TIS console action endpoints to an internal CIDR
location /tis-console/runtime/ {
    allow 10.0.0.0/8;
    deny all;
    limit_req zone=tis_console burst=10 nodelay;
    proxy_read_timeout 30s;
    proxy_pass http://tis_backend;
}