PT-2026-24048 · Apache · Apache Iotdb

Yongzhi Liu · Published 2026-03-09 · Updated 2026-03-09 · CVE-2026-24713

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache IoTDB versions 1.0.0 through 1.3.6 Apache IoTDB versions 2.0.0 through 2.0.6

Description An improper input validation issue exists in Apache IoTDB. The issue impacts the software’s ability to correctly handle user-supplied data, potentially leading to unexpected behavior or security compromises.

Recommendations Upgrade to version 1.3.7. Upgrade to version 2.0.7.

Fix

RCE

Weakness Enumeration

CWE-917

CWE-20

Related Identifiers

CVE-2026-24713

GHSA-6W48-2G9J-V9Q5

Affected Products

Apache Iotdb

References · 15

• https://osv.dev/vulnerability/GHSA-6w48-2g9j-v9q5 · Vendor Advisory
• https://lists.apache.org/thread/vopgv6y2ccw403b0zv7rvojjrh7x1j5p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24713 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24713 · Vendor Advisory
• https://github.com/apache/iotdb/commit/8fbfddc5f83771f1b339c457de597fe877f686d2 · Note
• https://github.com/apache/iotdb · Note
• https://github.com/apache/iotdb/compare/v2.0.6...v2.0.7 · Note
• https://github.com/apache/iotdb/releases/tag/v1.3.7 · Note
• https://github.com/apache/iotdb/compare/v1.3.6...v1.3.7 · Note
• https://github.com/apache/iotdb/releases/tag/v2.0.7 · Note
• https://twitter.com/CVEarity/status/2031005708922273880 · Twitter Post
• https://twitter.com/CVEnew/status/2031122559941382370 · Twitter Post
• https://t.me/CVEtracker/46884 · Telegram Post
• https://twitter.com/oss_security/status/2030919176122970124 · Twitter Post
• http://openwall.com/lists/oss-security/2026/03/09/4 · Note