CVE-2026-41114
Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
Apache Software Foundation Apache IoTDB JDBC driver
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.0.11Apache IoTDB JDBC driverCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver.
This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11.
Users are recommended to upgrade to version 2.0.11, which fixes the issue.
Text from CVE List
Affected versions 1
- Apache IoTDB JDBC driveraffected: 1.3.3 before 2.0.11CVE List