Critical Org.apache.iotdb CVEs
9 CVEs, 3 protected by Waratek
Overview 9 matches · 3 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
3
33.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
6
66.7%
blocked by ARMR today
3
33.3%
partly blocked
0
0.0%
not blocked
6
66.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
9
100.0%
split by
peak 4 / year
20201
No exploit published1
Critical1
not blocked1
No public exploit1
20210
20220
20232
Protected by Waratek1
No exploit published1
Critical2
blocked by ARMR today1
not blocked1
No public exploit2
20241
No exploit published1
Critical1
not blocked1
No public exploit1
20251
No exploit published1
Critical1
not blocked1
No public exploit1
20264
Protected by Waratek2
No exploit published2
Critical4
blocked by ARMR today2
not blocked2
No public exploit4
2020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-64152 | Critical | 2026-06-26 | Protected by Waratek | No public exploit | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue. |
| CVE-2025-55017 | Critical | 2026-06-26 | Protected by Waratek | No public exploit | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue. |
| CVE-2026-24713 | Critical | 2026-03-09 | No exploit published | No public exploit | Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue. |
| CVE-2026-24015 | Critical | 2026-03-09 | No exploit published | No public exploit | A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue. |
| CVE-2024-24780 | Critical | 2025-05-14 | No exploit published | No public exploit | Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI. This issue affects Apache IoTDB: from 1.0.0 before 1.3.4. Users are recommended to upgrade to version 1.3.4, which fixes the issue. |
| CVE-2023-46226 | Critical | 2024-01-15 | No exploit published | No public exploit | Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3.0, which fixes the issue. |
| CVE-2023-51656 | Critical | 2023-12-21 | Protected by Waratek | No public exploit | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue. |
| CVE-2023-24831 | Critical | 2023-04-17 | No exploit published | No public exploit | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3. Attackers could login without authorization. This is fixed in 0.13.4. |
| CVE-2020-1952 | Critical | 2020-04-27 | No exploit published | No public exploit | An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely. |