What is GHSA-776q-jw43-fhjx?

GHSA-776q-jw43-fhjx is a security advisory published by GitHub Security Advisories with Critical severity. Apache IoTDB: Deserialization of untrusted Data

Which CVE IDs does GHSA-776q-jw43-fhjx cover?

GHSA-776q-jw43-fhjx covers the following CVE IDs: CVE-2025-48459. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-776q-jw43-fhjx?

GHSA-776q-jw43-fhjx has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-776q-jw43-fhjx?

GHSA-776q-jw43-fhjx affects 2 products, including: maven/org.apache.iotdb:iotdb-confignode:\u003e= 1.0.0, \u003c 2.0.5; pip/apache-iotdb:\u003e= 1.0.0, \u003c 2.0.5.

GHSA-776q-jw43-fhjxCriticalCVSS 5.3

Apache IoTDB: Deserialization of untrusted Data

Vendor

GitHub Security Advisories

Published

September 24, 2025

Last Modified

June 5, 2026

🔗 CVE IDs covered (1)

CVE-2025-48459 →

📋 Description

Summary

Apache IoTDB deserializes data from external inputs without sufficient validation, allowing attacker-controlled serialized objects to be processed. In environments where a compatible gadget chain is reachable, this can be abused to execute arbitrary code or alter server state; at minimum it enables high-impact integrity and confidentiality compromise on the IoTDB process.

Affected

Apache IoTDB from 1.0.0 before 2.0.5.

Remediation

Upgrade to 2.0.5, which addresses the flaw. If immediate upgrade is not possible, restrict exposure of IoTDB endpoints to trusted networks and disable or sanitize any feature paths that accept serialized payloads. These mitigations are defense-in-depth only; upgrading to 2.0.5 is the definitive fix.

🎯 Affected products2

maven/org.apache.iotdb:iotdb-confignode:>= 1.0.0, < 2.0.5
pip/apache-iotdb:>= 1.0.0, < 2.0.5