Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-48459 EUVD-2025-30951GHSA-776q-jw43-fhjxPYSEC-2025-88

Apache IoTDB: Deserialization of untrusted Data

Published Sep 24, 2025 · Updated Nov 4, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache IoTDB Package: apache-iotdb Package: org.apache.iotdb:iotdb-confignode Ecosystem: Maven Ecosystem: PyPI

Description

Deserialization of Untrusted Data vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 2.0.5.

Users are recommended to upgrade to version 2.0.5, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache IoTDB 1.0.0 – < 2.0.5 2.0.5

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.iotdb:iotdb-confignode >= 1.0.0, < 2.0.5 2.0.5 GHSA-776q-jw43-fhjx
PyPI apache-iotdb >= 1.0.0, < 2.0.5 2.0.5 PYSEC-2025-88

References