CVE-2026-40454 | Out-of-bounds Read, Improper Input Validation vulnerability …

Description

Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Metadata

CVE ID: CVE-2026-40454
State: PUBLISHED
Assigner: apache
Reserved: 2026-04-13 09:02 UTC
Published: 2026-07-10 07:19 UTC
Last updated: 2026-07-10 07:19 UTC
Primary CWE: CWE-125
CWE-125 Out-of-bounds Read
Vendor / Product: Apache Software Foundation / Apache IoTDB C++ client
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Apache Software Foundation	Apache IoTDB C++ client	—	1.3.5 < 1.3.8, 2.0.5 < 2.0.10

Weakness (CWE)

CWE	Source	Description
CWE-125	cna	CWE-125 Out-of-bounds Read
CWE-20	cna	CWE-20 Improper Input Validation

References (1)

https://lists.apache.org/thread/9wml325g6bpovw0jf5ymtc3xl7fwlkrn