MavenPackage

org.apache.iotdb:iotdb-server

4 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2025-64152
Affects 1.0.0 to 1.3.5 (1.3.6 is outside it); 2.0.1-beta to 2.0.6 (2.0.7 is outside it)
CVE-2025-55017
Affects 1.0.0 to 1.3.5 (1.3.6 is outside it); 2.0.1-beta to 2.0.5 (2.0.6 is outside it)
CVE-2022-43766
Affects 0.12.2 to 0.13.2 (0.13.3 is outside it)
CVE-2022-38369
Affects 0.8.0 to 0.13.0 (0.13.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2025-64152Critical 9.1
Apache IoTDB: Path Traversal Vulnerability
Affected: from 1.0.0, fixed in 1.3.6; from 2.0.0, fixed in 2.0.7.
Fixed in 1.3.6 (released Dec 25, 2025, 183 days before disclosure) and 2.0.7 (released Feb 26, 2026, 120 days before disclosure).
The latest release, 2.0.11, is not affected.
CVE-2025-55017Critical 9.1
Apache IoTDB: Path Traversal Vulnerability
Affected: from 2.0.0, fixed in 2.0.6; from 1.0.0, fixed in 1.3.6.
Fixed in 1.3.6 (released Dec 25, 2025, 183 days before disclosure) and 2.0.6 (released Jan 15, 2026, 162 days before disclosure).
The latest release, 2.0.11, is not affected.
CVE-2022-43766High 7.5
Apache IoTDB prior to 0.13.3 allows DoS
Affected: from 0.12.2, fixed in 0.13.3.
Fixed in 0.13.3 (released Oct 17, 2022, 9 days before disclosure).
The latest release, 2.0.11, is not affected.
CVE-2022-38369Unrated
Login check vulnerability by session Id
Affected: fixed in 0.13.1.
Fixed in 0.13.1 (released Jul 31, 2022, 36 days before disclosure).
The latest release, 2.0.11, is not affected.