{"action":"Upgrade org.apache.iotdb:iotdb-confignode to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"1.0.0"}],"component":"org.apache.iotdb:iotdb-confignode","cve_ids":["CVE-2025-48459"],"ecosystem":"Maven","epss":0.0049,"exploited":false,"fixed_versions":["2.0.5"],"ghsa_id":"GHSA-776q-jw43-fhjx","id":"tcs_01M5N8HQMNNEB5CT89VXVD6ER3","modified_at":"2026-06-05T14:30:14.040965153Z","published_at":"2025-09-24T09:30:19Z","references":["https://osv.dev/vulnerability/GHSA-776q-jw43-fhjx","https://nvd.nist.gov/vuln/detail/CVE-2025-48459","https://github.com/apache/iotdb/commit/5ad4a940ed84abca27c7e8be86cb371a49900491","https://github.com/advisories/GHSA-776q-jw43-fhjx","https://github.com/apache/iotdb","https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-88.yaml","https://lists.apache.org/thread/mr84n19nv8d0bmcrfsj3mm5ff5qn4q2f","http://www.openwall.com/lists/oss-security/2025/09/24/8"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-776q-jw43-fhjx#Maven/org.apache.iotdb:iotdb-confignode","url":"https://osv.dev/vulnerability/GHSA-776q-jw43-fhjx"}],"summary":"Apache IoTDB: Deserialization of untrusted Data"}