Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-24713 EUVD-2026-10310GHSA-6w48-2g9j-v9q5

Apache IoTDB: JEXL Expression Injection Vulnerability

Published Mar 9, 2026 · Updated Mar 10, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache IoTDB Package: org.apache.iotdb:iotdb-core Ecosystem: Maven

Description

Improper Input Validation vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache IoTDB 1.0.0 – < 1.3.7, 2.0.0 – < 2.0.7 1.3.7

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.iotdb:iotdb-core >= 1.0.0, < 1.3.7 1.3.7 GHSA-6w48-2g9j-v9q5
Maven org.apache.iotdb:iotdb-core >= 2.0.0, < 2.0.7 2.0.7 GHSA-6w48-2g9j-v9q5

References