CVE-2026-40006: Apache IoTDB DoS Vulnerability

CVE-2026-40006 Overview

CVE-2026-40006 is a denial-of-service vulnerability in Apache IoTDB affecting the AirGap pipe receiver component. When pipe_air_gap_receiver_enabled=true, the receiver listens on TCP port 9780 without authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket, and readData passes it directly to new byte[length] without bounds validation. An unauthenticated remote attacker can force the Java Virtual Machine (JVM) to allocate up to 2,147,483,647 bytes per connection, exhausting heap memory and crashing the DataNode process. The flaw combines Missing Authentication for Critical Function [CWE-306] with unchecked resource allocation.

Critical Impact
Unauthenticated network attackers can crash or severely degrade any Apache IoTDB DataNode with the AirGap receiver enabled by sending a single crafted TCP packet.

Affected Products

Apache IoTDB versions 1.0.0 through 2.0.9
Apache IoTDB DataNode deployments with pipe_air_gap_receiver_enabled=true
Apache IoTDB clusters exposing TCP port 9780 to untrusted networks

Discovery Timeline

2026-07-10 - CVE-2026-40006 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-40006

Vulnerability Analysis

The vulnerability resides in the AirGap pipe receiver, an ingestion component used for cross-network data replication in Apache IoTDB. The receiver accepts raw TCP connections on port 9780 when pipe_air_gap_receiver_enabled=true. It performs no handshake, no token validation, and no source verification before reading data from the socket.

The receiver reads a length prefix using readLength, which returns a signed 32-bit integer under attacker control. This value flows directly into readData, which invokes new byte[length] to allocate the receive buffer. Because there is no upper bound applied, an attacker can request an allocation of up to Integer.MAX_VALUE (2,147,483,647 bytes, roughly 2 GB) per connection.

Repeated or parallel connections quickly exhaust JVM heap space. The DataNode process then throws OutOfMemoryError and crashes, or enters sustained garbage-collection thrashing that halts query and ingestion workloads.

Root Cause

Two defects combine to produce the impact. First, the AirGap receiver protocol lacks authentication for a critical function [CWE-306]. Second, the length field parsed from the network is treated as trusted input and is not bounded against buffer size limits, message-size ceilings, or available heap. The pattern is a classic Allocation of Resources Without Limits or Throttling weakness.

Attack Vector

Exploitation requires only network reachability to TCP port 9780 on a DataNode with the AirGap receiver enabled. The attacker opens a TCP connection and writes a length prefix indicating a very large payload. The receiver immediately attempts to allocate a byte array of that size. No credentials, tokens, or prior sessions are required. Because the trigger is a single small packet, the attack is trivially scriptable and can be repeated across cluster members to sustain the outage.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-40006

Indicators of Compromise

Repeated java.lang.OutOfMemoryError: Java heap space entries in DataNode logs correlated with inbound traffic on port 9780
DataNode process crashes or restarts shortly after receiving external TCP connections on the AirGap listener
Short-lived TCP connections to port 9780 from unexpected source addresses in network flow logs
Sudden heap usage spikes on IoTDB DataNodes without corresponding legitimate ingestion load

Detection Strategies

Inspect Apache IoTDB logs for AirGap receiver errors, allocation failures, and connection resets near the time of memory pressure events
Correlate JVM garbage-collection metrics and heap-usage telemetry with inbound connection counts on port 9780
Alert on any traffic to TCP port 9780 originating from outside approved AirGap peers

Monitoring Recommendations

Ingest IoTDB DataNode logs and JVM metrics into a centralized analytics platform for correlation with network telemetry
Track TCP connection rates, byte counts, and source IPs targeting port 9780 and alert on anomalies
Monitor DataNode process uptime and heap saturation, and page on repeated restarts within a short window

How to Mitigate CVE-2026-40006

Immediate Actions Required

Upgrade Apache IoTDB to version 2.0.10, which enforces bounds on the AirGap length field and remediates the missing authentication issue
If upgrading is not immediately possible, set pipe_air_gap_receiver_enabled=false in iotdb-common.properties and restart affected DataNodes
Restrict TCP port 9780 at the firewall to known AirGap peer addresses only
Audit cluster configurations across all environments to identify DataNodes with the AirGap receiver exposed to untrusted networks

Patch Information

The Apache IoTDB project fixed the issue in version 2.0.10. The patch adds an upper-bound check on the length value read from the socket before allocating the receive buffer. Details are available in the Apache Mailing List Discussion and the Openwall OSS-Security Update.

Workarounds

Disable the AirGap receiver by setting pipe_air_gap_receiver_enabled=false until patching is complete
Place IoTDB DataNodes behind a network segmentation boundary that blocks external access to port 9780
Apply host-based firewall rules that allow inbound connections to port 9780 only from allowlisted AirGap sender hosts

bash

# Configuration example - disable AirGap receiver in iotdb-common.properties
pipe_air_gap_receiver_enabled=false

# Restrict port 9780 to a specific AirGap peer using iptables
iptables -A INPUT -p tcp --dport 9780 -s 10.0.0.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 9780 -j DROP