CVE-2026-40008

Published: Jul 10, 2026Modified: Jul 10, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

Related CWEs

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

References (2)

https://lists.apache.org/thread/fm8cpvzbox2qqy99ztglm8wkk1nrg9ng

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/07/10/5

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.