Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.iotdb:iotdb-core

5 known vulnerabilities (4 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
2.0.11 (Sep 7, 2026): no advisory affects it
Newest unaffected release
2.0.11 (Sep 7, 2026), the latest release
Advisories
5 · 4 critical, 1 high
Dependents
0
Releases
20 since 1.3.0 (Dec 27, 2023)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-24713
    Affects 1.3.0 to 1.3.6 (1.3.7 is outside it); 2.0.1-beta to 2.0.6 (2.0.7 is outside it)
  • CVE-2026-24015
    Affects 1.3.0 to 1.3.6 (1.3.7 is outside it); 2.0.1-beta to 2.0.6 (2.0.7 is outside it)
  • CVE-2025-48392
    Affects 1.3.3 to 2.0.4 (2.0.5 is outside it)
  • CVE-2024-24780
    Affects 1.3.0 to 1.3.3 (1.3.4 is outside it)
  • CVE-2023-46226
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • CVE-2026-24713Critical 9.8

    Apache IoTDB: JEXL Expression Injection Vulnerability

    Affected: from 1.0.0, fixed in 1.3.7; from 2.0.0, fixed in 2.0.7.

    Fixed in 1.3.7 (released Feb 27, 2026, 10 days before disclosure) and 2.0.7 (released Feb 26, 2026, 11 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2026-24015Critical 9.8

    Apache IoTDB: Insecure Default Configuration Vulnerability

    Affected: from 1.0.0, fixed in 1.3.7; from 2.0.0, fixed in 2.0.7.

    Fixed in 1.3.7 (released Feb 27, 2026, 10 days before disclosure) and 2.0.7 (released Feb 26, 2026, 11 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • Apache IoTDB: DoS Vulnerability

    Affected: from 1.3.3, fixed in 2.0.5.

    Fixed in 2.0.5 (released Aug 18, 2025, 37 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2024-24780Critical 9.8

    Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function

    Affected: from 1.0.0, fixed in 1.3.4.

    Fixed in 1.3.4 (released Apr 14, 2025, 30 days before disclosure).

    The latest release, 2.0.11, is not affected.

  • CVE-2023-46226Critical 9.8

    Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

    Affected: from 1.0.0, fixed in 1.3.0.

    Fixed in 1.3.0 (released Dec 27, 2023, 19 days before disclosure).

    The latest release, 2.0.11, is not affected.