AI analysis
Apache Storm's worker Netty message decoder sits ahead of the SASL authentication handlers in the pipeline and allocates buffers sized from a length field carried in the frame, meaning it acts on unauthenticated input. Because storm.messaging.netty.authentication defaults to false and the decoder runs before the handler that would enforce it anyway, an attacker needs only TCP reachability to a worker slot port—no credentials—to send a single crafted frame that drives a large allocation. The result is remote denial of service: at the default 768 MB worker heap, a frame may cause anything from transient garbage-collection pressure to sustained worker loss, though the precise effect has not been measured. Any Apache Storm cluster prior to version 3.1.0 whose worker ports are reachable from outside the cluster is affected. No public proof of concept exists and no exploitation in the wild has been reported.
What to do: Upgrade to Apache Storm 3.1.0, where frames are decoded only after the handshake completes. Until then, enforce firewall or security-group rules so worker slot ports accept connections only from cluster-internal hosts, and enable storm.messaging.netty.authentication where the deployment permits. Monitor workers for heap pressure, GC thrashing, or unexpected restarts attributable to inbound frames on messaging ports.
Affected
| Apache Software Foundation Apache Storm | all versions prior to 3.1.0 |
Estimated exposure
nichelikely on the order of a few thousand self-hosted clusters worldwide, with internet-exposed worker ports uncommon — Apache Storm is a self-hosted distributed stream-processing framework with no public install telemetry, and its security model already expects worker slot ports to be reachable only within the cluster, so exposure is limited to clusters…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation. `storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port. The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration. Mitigation Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.