CVE-2026-82439
Deferred Deferred - Pending Action

Memory Leak in Apache Storm DRPC Server

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apache Software Foundation

Description
Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of the process. Function names come from the client and are not constrained to functions any topology has registered, so the number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are required to reach the endpoint. The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC server exhausts its heap. Mitigation Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it. Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82439
EUVD
EUVD-2026-77488

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache storm 3.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a memory leak in the DRPC server where function name entries are permanently retained in a map without cleanup. Attackers can exploit this by sending many distinct function names, causing the server to exhaust its heap memory over time.

Detection Guidance

This vulnerability can be detected by monitoring heap usage on the DRPC server and checking for an increasing number of function name entries in the internal map. Commands like 'jmap -heap <pid>' or 'jstat -gc <pid>' may help observe heap growth. Additionally, inspect network traffic to the DRPC port for unusual function names.

Impact Analysis

The vulnerability can lead to denial-of-service by crashing the DRPC server due to memory exhaustion. It may also allow unauthorized access if the drpc.authorizer is not configured, as no credentials are required by default.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server memory, potentially disrupting availability of systems handling sensitive data. For GDPR, this may impact the right to access or availability of services. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Immediately upgrade to Apache Storm 3.1.0 or later. If upgrading is not possible, configure 'drpc.authorizer' to restrict access to trusted principals and ensure DRPC ports are not exposed to untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart