Skip to content

Product

org.apache.iotdb/iotdb-server vulnerabilities

4 published CVES affecting org.apache.iotdb/iotdb-server, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
2
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest org.apache.iotdb/iotdb-server CVEs

Newest publication first

  1. CVE-2022-43766 Apache IoTDB prior to 0.13.3 allows DoS

    Published
    HighCVSS 7.5

    Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to avoid it.

  3. CVE-2025-55017 Apache IoTDB has a Path Traversal vulnerability

    CriticalCVSS 9.1

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

  4. CVE-2025-64152 Apache IoTDB has a Path Traversal vulnerability

    CriticalCVSS 9.1

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.