Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.iotdb:iotdb-confignode

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3MavenAmendedPublished

    Apache IoTDB: Deserialization of untrusted Data

    CVE-2025-48459 · GHSA-776q-jw43-fhjx

    Affected
    • Maven org.apache.iotdb:iotdb-confignode >= 1.0.0, < 2.0.5
    Fixed in
    2.0.5· Vendor fix available
    Issue
    Apache IoTDB deserializes data from external inputs without sufficient validation, allowing attacker-controlled serialized objects to be processed. In environments where a compatible gadget chain is reachable, this can be abused to execute arbitrary code or alter server state; at minimum it enables high-impact integrity and confidentiality compromise on the IoTDB process. Affected Apache IoTDB from 1.0.0 before 2.0.5. Remediation Upgrade to 2.0.5, which addresses the flaw. If immediate upgrade is not possible, restrict exposure of IoTDB endpoints to trusted networks and disable or sanitize any feature paths that accept serialized payloads. These mitigations are defense-in-depth only; upgrading to 2.0.5 is the definitive fix.

    Recommended action: Upgrade to 2.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →