{"id":"CVE-2026-41114","kind":"vulnerability","aliases":["CVE-2026-41114"],"related":[],"title":"Apache IoTDB JDBC driver: uncontrolled resource consumption from crafted input","description":"Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver.\n\n\n\nThis issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11.\n\n\n\nUsers are recommended to upgrade to version 2.0.11, which fixes the issue.","summary":"The Apache IoTDB JDBC driver from 1.3.3 before 2.0.11 consumes resources without limit in some path. An attacker who can send it crafted input can exhaust memory or CPU on the client that uses the driver.","severity":"unknown","cvss":null,"epss":0.00247,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-iotdb","java","jdbc","package"],"not_affected_if":["not-using-iotdb-jdbc"],"how_to_check":"- Check the IoTDB JDBC driver version in the project's build file or lockfile, for example `iotdb-jdbc` in `pom.xml` or `build.gradle`\n- Flag any version from `1.3.3` up to but not including `2.0.11`","fix":"- Upgrade the Apache IoTDB JDBC driver to `2.0.11` or later","status":"open","published_at":"2026-10-21T11:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:04:06+00:00","updated_at":"2026-10-25T05:04:06+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:04:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Apache IoTDB JDBC driver to `2.0.11` or later","reach":"unknown","title":"Apache IoTDB JDBC driver: uncontrolled resource consumption from crafted input","impact":"low","summary":"The Apache IoTDB JDBC driver from 1.3.3 before 2.0.11 consumes resources without limit in some path. An attacker who can send it crafted input can exhaust memory or CPU on the client that uses the driver.","category":"package","nicknames":[],"who_cares":["java","apache-iotdb","jdbc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Client process runs out of memory or CPU and stops responding","analyst_note":"Check the Apache IoTDB security advisory for the triggering input path and whether the attack is remote or requires credentials.","how_to_check":"- Check the IoTDB JDBC driver version in the project's build file or lockfile, for example `iotdb-jdbc` in `pom.xml` or `build.gradle`\n- Flag any version from `1.3.3` up to but not including `2.0.11`","needs_analyst":true,"not_affected_if":["not-using-iotdb-jdbc"],"who_is_affected":"Applications that bundle the Apache IoTDB JDBC driver from 1.3.3 before 2.0.11 are in scope. The sources do not say which input path triggers the consumption, so whether a given deployment receives untrusted input is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00061,"input_tokens":3347,"output_tokens":551,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-41114':13A,16A '1.3.3':29B,76C '2.0.11':31B,78C,86C 'affect':70C 'apach':1A,18B,24B,64C,71C 'apache-iotdb':17B 'attack':40B 'client':54B 'consum':32B 'consumpt':7A,61C 'cpu':51B 'craft':9A,45B 'cve':11A,14A 'driver':4A,27B,58B,67C,74C 'exhaust':48B 'fix':88C 'input':10A,46B 'iotdb':2A,19B,25B,65C,72C 'issu':69C,90C 'java':20B 'jdbc':3A,21B,26B,66C,73C 'limit':35B 'memori':49B 'packag':22B 'path':38B 'recommend':81C 'resourc':6A,33B,60C 'send':43B 'uncontrol':5A,59C 'upgrad':83C 'use':56B 'user':79C 'version':85C 'vulner':62C 'without':34B","nicknames":[],"mitigations":[],"who_affected":"Applications that bundle the Apache IoTDB JDBC driver from 1.3.3 before 2.0.11 are in scope. The sources do not say which input path triggers the consumption, so whether a given deployment receives untrusted input is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T11:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-41114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41114","severity":null,"published_at":"2026-10-21T11:17:07+00:00","modified_at":"2026-10-22T16:56:52+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-41114","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-41114","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}