CVE-2026-82435
Deferred Deferred - Pending Action

Heap-based Buffer Overflow in Apache Storm Netty Decoder

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation. `storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port. The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration. Mitigation Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82435
EUVD
EUVD-2026-77517

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache storm 3.1.0
apache storm to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Storm Worker (versions 3.0.0 before 3.1.0) involves unauthenticated remote memory exhaustion. The Netty message decoder processes frames before SASL authentication, allowing an attacker to send a malicious frame that allocates a large buffer based on a length field. No credentials are required for exploitation, as the decoder runs before authentication and the default setting is disabled.

Detection Guidance

Detecting this vulnerability requires checking Apache Storm Worker versions and network access to worker ports. Verify installed version with 'storm version' or check package managers like 'dpkg -l | grep storm' or 'rpm -qa | grep storm'. Scan for open worker slot ports (default 6700-6703) using 'netstat -tulnp | grep 670' or 'ss -tulnp | grep 670'. Monitor memory usage spikes on workers with 'jstat -gc <pid>' or system tools like 'top'/'htop'.

Impact Analysis

An attacker with TCP access to a worker port could send a single frame causing large memory allocation, potentially leading to worker loss or garbage collection pressure. The impact depends on the worker heap configuration, but severity is rated as important.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory exhaustion attacks on Apache Storm workers. Unauthenticated remote attackers could allocate large buffers, leading to worker instability or denial of service. This may violate requirements for data availability, integrity, and security controls in GDPR Article 32 and HIPAA Security Rule sections 164.308, 164.312, and 164.316.

Mitigation Strategies

Immediately upgrade Apache Storm to version 3.1.0 or later. If upgrading is not possible, restrict access to worker slot ports to cluster-internal networks only and enable authentication by setting 'storm.messaging.netty.authentication' to true in the configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart