CVE-2026-40007 describes an uncontrolled recursion vulnerability in Apache IoTDB's AirGap receiver when pipe_air_gap_receiver_enabled=true. The readLength method recursively calls itself each time it detects the E-language prefix in incoming socket data without limiting recursion depth. This allows an unauthenticated attacker to send a crafted stream of repeated E-language prefixes, driving the recursion arbitrarily deep, exhausting the JVM stack of the receiver thread, and causing a StackOverflowError. This affects Apache IoTDB versions from 1.0.0 up to but not including 2.0.10. The vulnerability is addressed by upgrading to version 2.0.10.

An unauthenticated attacker can cause a denial of service by triggering a StackOverflowError in the JVM running the Apache IoTDB AirGap receiver. This results from uncontrolled recursion in the readLength method when processing crafted socket data containing repeated E-language prefixes. The impact is resource exhaustion of the receiver thread's JVM stack, potentially disrupting service availability.

Users should upgrade Apache IoTDB to version 2.0.10 or later, where this uncontrolled recursion vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is not explicitly stated but the vendor recommends upgrading to 2.0.10 to resolve the issue.