IoTDB JDBC driver memory exhaustion fixed in 2.0.11 (CVE-2026-41114)
Original title: CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
Versions from 1.3.3 before 2.0.11 can exhaust memory via BigDecimal toPlainString.
An oss-security post by Haonan Hou on October 21 discloses CVE-2026-41114, an uncontrolled resource consumption flaw in the Apache IoTDB JDBC driver. It affects org.apache.iotdb:iotdb-jdbc from 1.3.3 before 2.0.11. Apache rates it low and recommends upgrading to 2.0.11.
Unconfirmed: The post does not say whether the flaw has been exploited.
- Trigger is BigDecimal toPlainString in the JDBC driver.
- Affected range is 1.3.3 before 2.0.11.
- Fixed version stated is 2.0.11.
- Severity is listed as low.
- Finders credited include Ho1aAs and movonow.
Impact: Large-scale memory exhaustion in the JDBC driver
| Product | Affected | Fixed in |
|---|---|---|
| Apache IoTDB JDBC driver | 1.3.3 before 2.0.11 | 2.0.11 |
- 1.Upgrade the Apache IoTDB JDBC driver to version 2.0.11.
- CVEs
- CVE-2026-41114
- Vendors
- Apache
- Products
- Apache IoTDB JDBC driver
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41114 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver | 7.5 | — |
From the original article
Posted by Haonan Hou on Oct 21 Severity: low Affected versions: - Apache IoTDB JDBC driver (org. apache. iotdb:iotdb-jdbc) 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.