Critical [CVE-2026-82439] Apache Storm: Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen
This critical-severity Apache Software Foundation advisory covers CVE-2026-82439; related products: Apache Storm.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
See Apache Software Foundation's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen.
No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of
the process.
Function names come from the client and are not constrained to functions any topology has registered, so the number of retained entries is bounded only by the number of distinct names an attacker chooses to send,
each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are
required to reach the endpoint.
The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC server exhausts its heap.
Affected product named by the advisory: Apache Storm.
- Apache Storm DRPC 3.0.0 before 3.1.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Mitigation Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it.
- Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-82427Sep 14, 2026Apache Storm: Description A topology's `topology.blobstore.map` lets the submitter choose
- CVE-2026-82428Sep 14, 2026Apache Storm: Description Dependency artifacts uploaded with `storm jar --artifacts` were
- CVE-2026-82429Sep 14, 2026Apache Storm: Description The setuid-root `worker-launcher` binary adjusts ownership
- CVE-2026-82430Sep 14, 2026Apache Storm: Description When launching a Docker or OCI worker, the setuid-root
- CVE-2026-82431Sep 14, 2026Apache Storm: Description `SimpleACLAuthorizer` evaluated the user-level command set
- CVE-2026-82433Sep 14, 2026Apache Storm: Description `getNimbusConf` returned the complete daemon configuration
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.