PT-2026-24048 · Apache · Apache Iotdb

Yongzhi Liu · Publicado 2026-03-09 · Atualizado 2026-03-09 · CVE-2026-24713

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.0.0 through 1.3.6 Apache IoTDB versions 2.0.0 through 2.0.6

Description An improper input validation issue exists in Apache IoTDB. The issue impacts the software’s ability to correctly handle user-supplied data, potentially leading to unexpected behavior or security compromises.

Recommendations Upgrade to version 1.3.7. Upgrade to version 2.0.7.

Correção

RCE

Enumeração de Fraquezas

CWE-917

CWE-20

Identificadores relacionados

CVE-2026-24713

GHSA-6W48-2G9J-V9Q5

Produtos afetados

Apache Iotdb

Referências · 15

• https://github.com/apache/iotdb/commit/8fbfddc5f83771f1b339c457de597fe877f686d2 · Nota
• https://github.com/apache/iotdb · Nota
• https://github.com/apache/iotdb/compare/v2.0.6...v2.0.7 · Nota
• https://github.com/apache/iotdb/releases/tag/v1.3.7 · Nota
• https://github.com/apache/iotdb/compare/v1.3.6...v1.3.7 · Nota
• https://github.com/apache/iotdb/releases/tag/v2.0.7 · Nota
• https://osv.dev/vulnerability/GHSA-6w48-2g9j-v9q5 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2031005708922273880 · Publicação no Twitter
• https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24713 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031122559941382370 · Publicação no Twitter
• https://t.me/CVEtracker/46884 · Publicação no Telegram
• https://twitter.com/oss_security/status/2030919176122970124 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24713 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/03/09/4 · Nota