CVE-2026-41114 PUBLISHED

Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver

Assigner: apache
Reserved: 17.04.2026 Published: 21.10.2026 Updated: 21.10.2026

Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver.

This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11.

Users are recommended to upgrade to version 2.0.11, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache IoTDB JDBC driver
Versions Default: unaffected
  • affected from 1.3.3 to 2.0.11 (excl.)

Credits

  • Ho1aAs (GitHub: @HolaAsuka) finder
  • movonow (GitHub: @movonow) finder
  • zhid889773 (GitHub: @zhid889773) finder
  • WA-888 (GitHub: @WA-888) finder
  • binghuangczc (Email: 572929574@qq.com) finder
  • errors11 (Github: @errors11) finder
  • Phoexina (Github: @Phoexina) finder
  • skydiver-jay (Github: @skydiver-jay) finder
  • V9d0g (Github: @V9d0g) finder
  • FlyFish (Email: 2811469022@qq.com) finder

References

Problem Types

  • CWE-400 Uncontrolled Resource Consumption CWE