Medium [CVE-2026-82440] Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it
This medium-severity Apache Software Foundation advisory covers CVE-2026-82440; related products: Apache Storm Nimbus.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Summary
Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. allowlist intended to constrain that choice, `nimbus.scheduler.strategy.class.whitelist`, was treated as
"allow any class" when unset, and it had no entry in the shipped `defaults.yaml`, so unset was the shipped state.
An authenticated submitter could therefore cause Nimbus to instantiate any class on the Nimbus classpath that has a no-argument constructor.
Storm's own production artifacts contain classes with side effects suitable for this: instantiating `org.apache.storm.testing.InProcessZookeeper` starts a ZooKeeper server with its own threads and sockets
and nothing closes it, and `org.apache.storm. LocalCluster` behaves similarly.
Repeated submissions therefore consume threads, sockets and memory in the most privileged daemon in the cluster.
Affected product named by the advisory: Apache Storm Nimbus.
Is CVE-2026-82440 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-82440 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-82440?
Upgrade to a fixed release named by Apache:
- 3.1.0
Confirm against the vendor advisory before you patch.
- Apache Storm Nimbus 3.0.0 before 3.1.0
Official advisory · high-confidence parse· fetched 1 day ago·verify at source
Mitigation checklist
- Mitigation Upgrade to 3.1.0, where an unset allowlist means the strategies shipped with Storm rather than any class.
- Users who cannot upgrade immediately should set `nimbus.scheduler.strategy.class.whitelist` explicitly to the strategies they intend to permit.
Official advisory · high-confidence parse· fetched 1 day ago·verify at source
Get an email when Apache Data & Analytics (Spark/Hadoop/Gravitino) publishes the next one.
See Apache Data & Analytics (Spark/Hadoop/Gravitino)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
More Apache Software Foundation advisories
- CVE-2026-82441Sep 14, 2026A submitted topology carries two lists of blobstore keys, `dependency_jars`
- CVE-2026-119078Nov 9, 2026Apache Commons Codec's Blake3 class documented the output of its doFinalize methods
- CVE-2026-124077Nov 9, 2026The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry
- CVE-2026-120367Nov 9, 2026Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java
- CVE-2026-123779Nov 9, 2026Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java
- CVE-2026-123753Nov 9, 2026Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java
iPhone and Android apps · New on the App Store
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.