📊 HiddenMerit Morning Post · Issue 73

Focus on Database Frontiers, Practical Insights for DBAs August 11, 2026 ｜ 5 Selected Global Breaking News

01｜Apache IoTDB Exposes Unauthenticated DoS Vulnerability (CVE-2026-44630): Malicious Thrift Frames Can Trigger Memory Exhaustion and Crash

On August 10, the Apache Foundation officially disclosed a severe denial‑of‑service vulnerability in IoTDB (CVE-2026-44630), affecting Apache IoTDB versions before 1.3.8 and versions 2.0.0 through 2.0.9.

Vulnerability Details: The vulnerability stems from improper validation of the Thrift protocol length field in the Apache IoTDB RPC service. An unauthenticated remote attacker can send specially crafted malformed Thrift frames, causing IoTDB to allocate excessive memory and crash due to an OutOfMemoryError.

Remediation: Upgrade to Apache IoTDB 2.0.10 or higher. As an open‑source database widely deployed in industrial IoT and time‑series data management, instances with RPC services exposed to the public internet are at higher risk.

• DBA Perspective: This is another typical case in time‑series database security. The consecutive disclosures of CVE-2026-44630 and last week’s TimescaleDB out‑of‑bounds read (CVE-2026-70634) reflect that security testing coverage for time‑series databases during rapid iteration remains insufficient. IoTDB’s RPC service can trigger an OOM without authentication, meaning an attacker could take down the service with just a few malicious requests. DBAs using IoTDB should immediately check versions (SELECT @@version), and implement IP whitelisting and rate limiting on RPC ports exposed to the public internet.

02｜Dameng Receives Another Major Shareholder Increase to 26.96%, Signaling Continued Industrial Capital Confidence

On August 7, Dameng (688692) announced that shareholder CEC Investment Holdings Co., Ltd. increased its shareholding by 2,217,000 shares (representing 1.96% of total share capital) via block trading on August 6. After this increase, the combined shareholding of CEC Investment and its concert party China Software rose from 25.00% to 26.96% , with the equity change reaching a 1% multiple.

The announcement explicitly stated that the increase was implemented by China Electronics Corporation Group through its wholly‑owned subsidiary CEC Investment, based on “strong confidence in the company’s future sustainable and stable development,” with all funds coming from its own capital. On July 28, CEC Investment had already increased its shareholding by 11,758 shares via block trading, raising its holding from 24.99% to 25.00%. Dameng’s 2025 revenue was RMB 1.306 billion, with net profit of RMB 515 million.

During the same period, Dameng appeared at the 41st China Computer Application Conference (CCF NCCA 2026), jointly launching the “Digital Intelligence Industry Innovation Joint Development Plan” and the “Database Industry Ecosystem Construction Joint Initiative” with industry partners, signalling the “national team” of domestic databases joining forces to build the ecosystem.

• DBA Perspective: Two increases within a month, with the shareholding approaching 27%, sends a strong signal of continued bullishness from industrial capital toward leading domestic database vendors. The strong endorsement from China Electronics Corporation, a key state‑owned enterprise, provides confidence in ecosystem stability for DBAs selecting Dameng products in Xinchuang projects in finance, government, and other sectors. Dameng’s “3A1H” (AI+Agent+Application+Human) framework for service object expansion, proposed at CCF NCCA 2026, provides DBAs with a clear framework for understanding the evolution of databases in the AI era.

03｜Three Ant Group Subsidiaries Pursue Independent Financing: OceanBase Aims to Be “China’s Databricks”

Three Ant Group subsidiaries are accelerating independent financing processes. OceanBase has launched its Series A funding round targeting RMB 2‑3 billion, with 2026 annualised revenue exceeding RMB 1.4 billion and approximately 70% year‑on‑year growth – described by Bloomberg as “China’s Databricks.” Ant Digital is preparing for a Pre‑IPO round, and Ant International completed a Series A round of approximately $1.2 billion in July. Ant’s multiple business units are progressively establishing independent governance and financing mechanisms.

• DBA Perspective: OceanBase benchmarking itself against “China’s Databricks” means its strategic direction is extending from a “distributed database company” to an “AI data platform.” For DBAs, this transformation means skills need to expand from “distributed database operations” to “AI data platform architecture and multi‑modal data management.”

04｜Dameng Strategic Focus Shifts to Next‑Generation All‑in‑One: Driving Domestic Databases from “Usable” to “Good‑to‑Use”

On August 6, Dameng stated during an investor research visit that after achieving breakthroughs in key core technologies such as shared storage clusters, its strategic focus is gradually shifting toward the next‑generation database all‑in‑one business. Through deep integration and collaborative optimisation of hardware and software, the product aims to deliver higher performance, easier deployment, and higher availability data infrastructure, precisely matching the dual demands of autonomous control and extreme performance in key industries such as finance, energy, and telecommunications.

Dameng stated it will focus on building a data foundation for the AI era, driving domestic databases from “usable” to “good‑to‑use,” and comprehensively empowering digital transformation across industries.

• DBA Perspective: Dameng’s strategic shift toward all‑in‑one products confirms the trend of domestic databases moving from “software replacement” to “hardware‑software synergy.” For DBAs, the all‑in‑one delivery model means the barrier to database deployment and tuning will be lowered, but it also requires DBAs to have a holistic view of hardware‑software synergy, understanding the integrated tuning logic of storage, networking, and compute. The measured data from Dameng’s previously released DAMENG PAI V2.0 all‑in‑one – I/O latency reduced from 400μs to 80μs – provides a quantifiable reference for selection in core scenarios such as finance and energy.

05｜Weekly Security Vulnerabilities Focus: Metabase CVSS 10.0 Zero‑Day, CVE-2026-72900 Information Disclosure

Metabase CVSS 10.0 Zero‑Day SQL Injection: Disclosed on August 6, this unauthenticated SQL injection vulnerability in Metabase has a CVSS score of 10.0, with in‑the‑wild exploitation already observed. The vulnerability resides in the /api/session/reset_password interface. An unauthenticated attacker can inject arbitrary SQL to gain administrator privileges, leading to configuration tampering, database credential leakage, and business data exposure. Affected versions cover branches 1.58 through 1.63. Patched versions include: 1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, and 1.63.5. All Metabase self‑hosted instances should be upgraded immediately.

CVE-2026-72900 (Metabase Information Disclosure) : CVSS v4 score 7.1 (High), allowing low‑privilege authenticated attackers to read the entire Metabase application database. A security advisory has been issued, recommending strict role‑based access controls.

• DBA Perspective: Metabase has disclosed two high‑risk vulnerabilities in a single week – one allowing unauthenticated RCE (CVSS 10.0), and another allowing low‑privilege users to read the full database (CVSS 7.1). This demonstrates that BI platform security configurations are often overlooked. Metabase typically holds high‑privilege database connections; once compromised, it can become a bridge for attackers to enter internal networks. DBAs should immediately check self‑hosted Metabase versions, upgrade to patched versions, and review the credentials and permissions of connected databases.

📚 SQL Little Knowledge Point

This Issue’s Knowledge Point: What is the Thrift Protocol and Length Field Validation Risk?

Apache IoTDB’s CVE-2026-44630 vulnerability stems from a length field validation flaw in the Thrift RPC protocol. Thrift is a cross‑language RPC framework developed by the Apache Software Foundation, widely used for inter‑service communication in distributed systems.

Length Fields in the Thrift Protocol: In Thrift’s binary protocol, messages typically contain a length field that informs the receiver of the total byte count of the message, allowing the receiver to allocate buffers and parse subsequent content.

Vulnerability Principle: IoTDB’s RPC service does not perform upper‑bound validation on the length field in Thrift frames. An attacker can craft a malformed Thrift frame claiming an excessively large length (e.g., 2^31 bytes), causing the server to attempt to allocate an oversized memory buffer, ultimately triggering an OutOfMemoryError crash.

Security Implications for Time‑Series Databases: The consecutive disclosures of CVE-2026-44630 and CVE-2026-70634 (TimescaleDB out‑of‑bounds read) indicate that security testing coverage for RPC protocol layers and compression algorithm layers during rapid iteration of time‑series databases remains insufficient. It is recommended to implement IP whitelisting and rate limiting on RPC ports exposed to the public internet, and to monitor vendor security advisories.

HiddenMerit Team Production Slogan: 绩优隐于内，金石启新程 | Hidden deep. Merit bold. Forge ahead.