Apache IoTDB: DoS Vulnerability

Vulnerability

Overview

CVE-2025-48392 is a denial-of-service (DoS) vulnerability affecting Apache IoTDB, a time-series database management system. The issue impacts versions 1.3.3 through 1.3.4 and 2.0.1-beta through 2.0.4 [1][2][3]. The root cause lies in how the software handles certain requests, potentially allowing an attacker to cause excessive resource consumption or crash the service.

Exploitation

An attacker can exploit this vulnerability without requiring authentication, as the attack vector is network-based. By sending specially crafted requests to an affected IoTDB instance, the attacker can trigger the DoS condition. No special privileges or user interaction are needed for exploitation [3].

Impact

Successful exploitation leads to a denial-of-service condition, making the IoTDB service unavailable to legitimate users. This can disrupt time-series data collection, storage, and analysis operations that rely on IoTDB, potentially affecting industrial IoT systems and other dependent applications [1][3].

Mitigation

The Apache IoTDB project has released version 2.0.5, which fixes the vulnerability. Users are recommended to upgrade immediately. No workarounds have been provided for affected versions [2][3].