The vulnerability stems from an uncontrolled recursion in the IoTDB AirGap receiver’s E‑language prefix parser. When the configuration setting pipe_air_gap_receiver_enabled is true, the readLength method calls itself repeatedly for each recognized prefix without imposing any depth limit. An unauthenticated attacker can therefore send a continuous stream of E‑language prefixes, causing the recursion depth to explode until the receiver thread’s JVM stack overflows, which raises a StackOverflowError and effectively halts the processing of that connection. This results in a denial‑of‑service condition on the affected system.

Apache IoTDB versions from 1.0.0 up to but not including 2.0.10 are affected, but only when the AirGap receiver feature is enabled through the pipe_air_gap_receiver_enabled setting. The flaw is present in the receiver component that listens on the AirGap endpoint, which may be exposed over the network.

The CVSS score of 7.5 classifies the issue as high severity. An EPSS score of less than 1 % indicates that publicly observed exploitation has been rare, and it is not listed in the CISA KEV catalog. Nonetheless, the vulnerability can be triggered with unauthenticated network access to the AirGap receiver, requiring only the ability to send arbitrary data to the open socket. Once exploited, the recursion can exhaust stack resources, causing the server thread to crash and denying service to legitimate clients. The low exploitation probability does not mitigate the potential impact on exposed services.