Apache IoTDB lacks boundaries on the time span and aggregation interval that can be requested, creating a resource exhaustion weakness (CWE-400). An attacker who can send a query with a large time range and a very small interval forces the DataNode to assemble an enormous result set in memory, exhausting the Java heap and causing the DataNode process to terminate. The crash results in a service outage for all clients' availability.

The flaw affects all Apache IoTDB deployments running versions from 1.3.3 up to but not including 2.0.8. Any installation that exposes the vulnerable aggregation query interface is susceptible.

The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely at this time. The issue is not listed in the CISA KEV catalog. Attackers can trigger the failure by sending a crafted aggregation query that spans a very large time range with a minimal interval. Based on the description, it is inferred that the attacker does not need any special privileges beyond the ability to communicate with the vulnerable service over the network.