An attacker can send a malformed Thrift frame that, due to the lack of proper length validation in the RPC service, forces Apache IoTDB to allocate an unreasonably large amount of memory, leading to an OutOfMemoryError and crash of the server. The flaw is an unchecked length field (CWE‑400) combined with insufficient bounds checking (CWE‑789), giving rise to a denial‑of‑service condition that can be triggered without authentication. The result is that the affected service becomes unavailable to legitimate users.

The vulnerability affects the Apache IoTDB database product from the Apache Software Foundation. All releases before 1.3.8 and the 2.0.0 series before 2.0.9 are vulnerable. Users must update to version 2.0.10 or later to eliminate the flaw.

The RPC interface is exposed over the network and does not require authentication, so remote attackers can trigger the flaw by sending crafted data from any host that can reach the service. Because EPSS is currently unavailable, the likelihood of exploitation is not quantified, but an unpatched system is at high risk of service disruption. The vulnerability is not listed in the CISA KEV catalog, indicating that there is no known widespread exploitation reported yet, but the impact remains significant for organizations relying on high availability.