The vulnerability is a lack of authentication and no input validation for the data length field in the IoTDB AirGap pipe receiver. An unauthenticated TCP client can supply a 32‑bit size value that the server copies into a byte array without an upper‑bound check. This allows an attacker to trigger an allocation of up to 2 GB of heap memory per connection, potentially exhausting the JVM heap and causing is a heap‑exhaustion denial‑of‑service attack rooted in CWE‑770 (Uncontrolled Memory Allocation), CWE‑789 (Out‑of‑Bound Allocation), and CWE‑306 (Missing Authentication).

Affected are installations of Apache IoTDB from version 1.0.0 up to2.0.10. Systems running these versions with the AirGap pipe receiver enabled (pipe_air_gap_receiver_enabled=true) are vulnerable. The fix is present in Apache IoTDB 2.0.10 and later.

The CVSS base score of 7.5 indicates a high severity. The EPSS score is less than 1 %, suggesting a low probability of widespread exploitation but could still be targeted by a determined adversary. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote over the network, requiring the target to expose port 9780 and have the AirGap pipe receiver enabled, so any external host with network access to the target could trigger the denial‑of‑service.