CVE-2026-40007: Apache IoTDB AirGap Receiver DoS Flaw

CVE-2026-40007 Overview

CVE-2026-40007 is an uncontrolled recursion and resource exhaustion vulnerability in Apache IoTDB. The flaw resides in the AirGap receiver's readLength method, which recursively calls itself each time it detects the E-language prefix in socket data. The recursion has no depth limit, allowing an unauthenticated remote attacker to exhaust the receiver thread's Java Virtual Machine (JVM) stack and trigger a StackOverflowError. The issue affects Apache IoTDB versions 1.0.0 through 2.0.9 when pipe_air_gap_receiver_enabled=true. Upgrading to version 2.0.10 remediates the issue. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption).

Critical Impact
An unauthenticated network attacker can crash the IoTDB AirGap receiver by sending repeated E-language prefixes, causing denial of service against the data pipeline component.

Affected Products

Apache IoTDB 1.0.0 through 2.0.9
IoTDB deployments with pipe_air_gap_receiver_enabled=true
Apache IoTDB AirGap receiver component

Discovery Timeline

2026-07-10 - CVE-2026-40007 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-40007

Vulnerability Analysis

The vulnerability is a stack-based resource exhaustion flaw in the Apache IoTDB AirGap receiver. The AirGap receiver is a network-facing component that ingests replicated data streams into IoTDB when air-gap replication is enabled. The readLength method parses framed messages from the incoming socket. When it encounters an E-language prefix, it invokes itself recursively to parse the next frame.

The recursive call path contains no bounded depth check. Each recursion consumes a JVM stack frame on the receiver thread. An attacker who repeatedly transmits the E-language prefix drives the recursion arbitrarily deep. The thread's stack fills and the JVM raises StackOverflowError, terminating the receiver thread and disrupting the ingestion pipeline.

The attack requires no authentication, no user interaction, and can be delivered across the network. Confidentiality and integrity are unaffected, but availability of the AirGap ingest path is disrupted.

Root Cause

The root cause is an unbounded self-recursive parser. The readLength implementation treats the E-language prefix as a signal to descend one level and re-invoke itself, without tracking or enforcing a maximum call depth. Attacker-controlled input directly drives the recursion count.

Attack Vector

An attacker establishes a TCP connection to the AirGap receiver port and sends a stream of concatenated E-language prefixes. Each prefix triggers a nested readLength invocation. Once the JVM thread stack is exhausted, the receiver thread aborts. Repeating the attack denies service to the ingestion component.

No verified proof-of-concept code has been published. See the Apache Mailing List Discussion and the Openwall OSS Security Update for technical details.

Detection Methods for CVE-2026-40007

Indicators of Compromise

StackOverflowError entries in IoTDB receiver logs referencing the readLength call chain
Unexpected termination or restart of the AirGap receiver thread
Repeated inbound connections to the AirGap receiver port carrying the E-language byte prefix
Abrupt gaps in ingestion metrics from AirGap-connected pipelines

Detection Strategies

Monitor IoTDB JVM logs for java.lang.StackOverflowError originating in AirGap receiver classes
Inspect network traffic to the AirGap receiver port for anomalous streams of repeated identical prefix bytes
Correlate receiver thread crashes with source IP addresses to identify attacker origin
Track ingestion latency and pipeline health metrics for sudden drops that align with receiver restarts

Monitoring Recommendations

Enable verbose logging on the AirGap receiver during the mitigation window to capture parser errors
Alert on any occurrence of StackOverflowError in IoTDB process logs
Baseline normal connection volume to the AirGap port and alert on deviations
Forward IoTDB logs and network flow data to a centralized analytics platform for correlation

How to Mitigate CVE-2026-40007

Immediate Actions Required

Upgrade Apache IoTDB to version 2.0.10 or later, which removes the unbounded recursion
If upgrade is not immediately possible, set pipe_air_gap_receiver_enabled=false to disable the vulnerable receiver
Restrict network access to the AirGap receiver port using firewall rules to trusted replication peers only
Review IoTDB logs for prior StackOverflowError events that may indicate exploitation attempts

Patch Information

The Apache IoTDB project has released version 2.0.10, which fixes CVE-2026-40007 by bounding the recursion in readLength. All deployments running versions 1.0.0 through 2.0.9 with the AirGap receiver enabled must upgrade. Details are available in the Apache Mailing List Discussion.

Workarounds

Disable the AirGap receiver by setting pipe_air_gap_receiver_enabled=false in the IoTDB configuration
Place the receiver behind a network access control list that permits only known replication source IPs
Deploy a TCP-layer rate limiter in front of the AirGap port to reduce the volume of malformed streams a single peer can send
Monitor and auto-restart the IoTDB service to reduce outage duration while patching is scheduled

bash

# Configuration example: disable the vulnerable AirGap receiver in iotdb-common.properties
pipe_air_gap_receiver_enabled=false