Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82435— Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Quick assessment

Affected
Apache Software Foundation Apache Storm Worker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述 在 Netty 消息处理管线中，Worker 的 Netty 消息解码器被安装在 SASL 认证处理器之前，因此在任何认证发生之前就会处理接收到的帧。该解码器根据帧中携带的长度字段来分配缓冲区，因此来自未认证对等方的单个帧，如果该对等方能够访问 Worker 插槽端口，就可能触发大内存分配。 默认为 ，且解码器在任何情况下都运行在强制认证的处理程序之前，因此无需凭证即可触发。攻击者只需具备到 Worker 端口的 TCP 可达性即可利用此漏洞。 在默认 768 MB Worker 堆内存配置下，单个帧的影

AI Predicted 7.5 Difficulty: Moderate
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82435

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
Source: CVE Program / CVE List V5
Vulnerability Description
Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation. `storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port. The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration. Mitigation Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Storm Worker 3.0.0 ~ 3.1.0 -

II. Public POCs for CVE-2026-82435

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82435

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-82435 (1)

Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total

CVE-2026-82434 10.0 CRITICAL Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential
CVE-2026-78330 Apache Syncope: Privilege escalation for admin user via JWT authentication
CVE-2026-73579 Apache Syncope: Non-recursive Any search could skip Realms restrictions
CVE-2026-75015 Apache Syncope: Nested secrets leak cleartext into audit records readable
CVE-2026-75030 Apache Syncope: Incomplete authorization checks for Group members deprovisioning
CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
CVE-2026-73668 Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
CVE-2026-77147 Apache Syncope: Groovy Sandbox escape for empty CommandArgs
CVE-2026-77181 Apache Syncope: ClientApp update entitlement not effective
CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui
CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles
CVE-2026-78336 Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
CVE-2026-82232 Apache Syncope: SQL injection via sort parameter in Task search
CVE-2026-86460 Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
CVE-2026-87779 Apache Syncope: AES Secret Key disclosure via log output
CVE-2026-87785 Apache Syncope: JWT subject spoofing
CVE-2026-87802 Apache Syncope: SRA OAuth2 JWT signature verification bypass
CVE-2026-68570 Apache Doris: Authorization bypass leading to unauthorized data access
CVE-2026-72524 Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-789

V. Comments for CVE-2026-82435

No comments yet

Leave a comment