---
id: "CVE-2026-41114"
kind: "vulnerability"
aliases: ["CVE-2026-41114"]
title: "Apache IoTDB JDBC driver: uncontrolled resource consumption from crafted input"
severity: "unknown"
cvss: null
epss: 0.00247
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-iotdb", "java", "jdbc", "package"]
not_affected_if: ["not-using-iotdb-jdbc"]
published_at: "2026-10-21T11:17:07+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T05:04:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41114", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-41114", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache IoTDB JDBC driver: uncontrolled resource consumption from crafted input

The Apache IoTDB JDBC driver from 1.3.3 before 2.0.11 consumes resources without limit in some path. An attacker who can send it crafted input can exhaust memory or CPU on the client that uses the driver.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the IoTDB JDBC driver version in the project's build file or lockfile, for example `iotdb-jdbc` in `pom.xml` or `build.gradle`
- Flag any version from `1.3.3` up to but not including `2.0.11`

## Fix

- Upgrade the Apache IoTDB JDBC driver to `2.0.11` or later

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-41114
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-41114

## From the sources

Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver.



This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11.



Users are recommended to upgrade to version 2.0.11, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_