Apache IoTDB JDBC driver versions before 2.0.11 contain a flaw that allows an attacker to trigger uncontrolled memory consumption by forcing the driver to convert large BigDecimal values to plain string representations. This overflow can exhaust available RAM, resulting in application crashes or denial of service for legitimate users.

The vulnerability affects the Apache IoTDB JDBC driver provided by the Apache Software Foundation, specifically all releases from 1.3.3 through 2.0.10. Any application using these driver versions with the ability to supply large numeric data is at risk.

The EPSS score indicates a very low exploitation probability (< 1%) and the vulnerability is not listed in CISA KEV, but the absence of mitigations combined with the medium‑high CVSS score of 7.5 suggests a significant risk. While the exact attack vector is not explicitly stated, it is inferred that an attacker could send oversized numeric payloads via JDBC queries, causing the driver to allocate excessive memory. The medium‑high CVSS score highlights the potential for substantial resource exhaustion and service denial.