CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

Apache Storm's worker Netty message decoder sits ahead of the SASL authentication handlers in the pipeline and allocates buffers sized from a length field carried in the frame, meaning it acts on unauthenticated input. Because storm.messaging.netty.authentication defaults to false and the decoder runs before the handler that would enforce it anyway, an attacker needs only TCP reachability to a worker slot port—no credentials—to send a single crafted frame that drives a large allocation. The result is remote denial of service: at the default 768 MB worker heap, a frame may cause anything from transient garbage-collection pressure to sustained worker loss, though the precise effect has not been measured. Any Apache Storm cluster prior to version 3.1.0 whose worker ports are reachable from outside the cluster is affected. No public proof of concept exists and no exploitation in the wild has been reported.

Do: Upgrade to Apache Storm 3.1.0, where frames are decoded only after the handshake completes. Until then, enforce firewall or security-group rules so worker slot ports accept connections only from cluster-internal hosts, and enable storm.messaging.netty.authentication where the deployment permits. Monitor workers for heap pressure, GC thrashing, or unexpected restarts attributable to inbound frames on messaging ports.