CyberRota Analysis
AI-GeneratedApache IoTDB versions prior to 2.0.10 are vulnerable to an uncontrolled recursion issue in the AirGap receiver's readLength method, which can be exploited by unauthenticated attackers to send repeated E-language prefixes. This can lead to resource exhaustion, specifically a StackOverflowError, potentially causing denial of service. Organizations using affected versions should prioritize upgrading to 2.0.10 to mitigate this high-severity vulnerability.
Original NVD Description
Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily deep, exhausting the receiver thread's JVM stack and raising StackOverflowError. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.