Apache IoTDB JDBC driver versions before 2.0.11 contain a flaw that allows an attacker to trigger uncontrolled memory consumption by forcing the driver to convert large BigDecimal values to plain string representations. This overflow can exhaust available RAM, resulting in application crashes or denial of service for legitimate users.

The vulnerability affects the Apache IoTDB JDBC driver provided by the Apache Software Foundation, specifically all releases from 1.3.3 through 2.0.10. Any application using these driver versions with the ability to supply large numeric data is at risk.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the absence of mitigations and the high potential for downtime suggests a significant risk. While the exact attack vector is not explicitly stated, it is inferred that an attacker could send oversized numeric payloads via JDBC queries, causing the driver to allocate excessive memory. No CVSS score is supplied, so the severity must be judged by the described denial‑of‑service impact rather than an objective metric.