CVE-2026-82439— Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Quick assessment
Affected
Apache Software Foundation Apache Storm DRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
描述 DRPC 服务器维护了一个从函数名到请求队列的映射表，并在首次遇到某个函数名时创建对应条目。没有任何代码路径会移除这些条目：请求清理仅从队列中移除请求，而关闭流程会清空队列，但队列对象及其在映射表中的条目会一直保留到进程结束。 函数名来自客户端，且不限于任何拓扑中已注册的函数，因此保留的条目数量仅受攻击者选择发送的不同名称数量限制，且每个保留条目都会持有该名称本身。 默认未设置，因此访问该端点无需身份验证。 由于保留的状态是永久性的，而非瞬时的负载峰值，其影响会持续累积，直至 DRPC 服务器耗尽堆内存。 缓
Possible ATT&CK Techniques 1 AI
T1074 · Data Staged
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82439
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Source: CVE Program / CVE List V5
Vulnerability Description
Description
The DRPC server kept a map from function name to request queue and created an entry the first time a
function name was seen. No code path ever removed an entry: request cleanup removed the request from its
queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of
the process.
Function names come from the client and are not constrained to functions any topology has registered, so the
number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and
each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are
required to reach the endpoint.
The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC
server exhausts its heap.
Mitigation
Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it.
Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can
reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Storm DRPC | 3.0.0 ~ 3.1.0 | - |
|
II. Public POCs for CVE-2026-82439
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82439
请登录查看更多情报信息。
Other References for CVE-2026-82439 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-14 · 39 CVEs total
| CVE-2026-82434 | 10.0 CRITICAL | Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential |
| CVE-2026-78330 | Apache Syncope: Privilege escalation for admin user via JWT authentication | |
| CVE-2026-73579 | Apache Syncope: Non-recursive Any search could skip Realms restrictions | |
| CVE-2026-75015 | Apache Syncope: Nested secrets leak cleartext into audit records readable | |
| CVE-2026-75030 | Apache Syncope: Incomplete authorization checks for Group members deprovisioning | |
| CVE-2026-77051 | Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search | |
| CVE-2026-73668 | Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values | |
| CVE-2026-77147 | Apache Syncope: Groovy Sandbox escape for empty CommandArgs | |
| CVE-2026-77181 | Apache Syncope: ClientApp update entitlement not effective | |
| CVE-2026-77883 | Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBui | |
| CVE-2026-78318 | Apache Syncope: Unauthenticated reflected XSS in Console and Enduser | |
| CVE-2026-73470 | Apache Syncope: Delegating users can grant unowned Roles | |
| CVE-2026-78336 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user | |
| CVE-2026-82232 | Apache Syncope: SQL injection via sort parameter in Task search | |
| CVE-2026-86460 | Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence | |
| CVE-2026-87779 | Apache Syncope: AES Secret Key disclosure via log output | |
| CVE-2026-87785 | Apache Syncope: JWT subject spoofing | |
| CVE-2026-87802 | Apache Syncope: SRA OAuth2 JWT signature verification bypass | |
| CVE-2026-68570 | Apache Doris: Authorization bypass leading to unauthorized data access | |
| CVE-2026-72524 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitr |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-82427
Apache Storm Nimbus: Path Traversal as the Supervisor User v -
CVE-2026-82428
Apache Storm Client: Cross-Tenant Dependency Jar Substitutio -
CVE-2026-82429
Apache Storm Worker Launcher: Local Privilege Escalation to -
CVE-2026-82430
Apache Storm Worker Launcher: Local Privilege Escalation to -
CVE-2026-82431
Apache Storm Client: Authorization Bypass When nimbus.groups
Same weakness: CWE-770
-
CVE-2026-11993
Fix authenticated members disabling file content indexing se -
CVE-2026-90584
TooTallNate Java-WebSocket Fragmentation Draft_6455.java pro -
CVE-2026-90668
UnrealIRCd 6.2.6 HTTP头部限制缺失致拒绝服务 -
CVE-2026-48496
opentelemetry-ebpf-profiler: Unprivileged process can trigge -
CVE-2026-88012
Traefik: respondingTimeouts.readTimeout is not applied to HT
V. Comments for CVE-2026-82439
No comments yet