CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Unauthenticated DRPC requests to Apache Storm 3.0.0 cause unbounded memory growth in the function-name queue map, enabling DoS.
CVE-2026-82439 (severity: important) affects Apache Storm DRPC (storm-server) versions 3.0.0 before 3.1.0. The DRPC server maintained a map from function name to request queue, creating an entry on first sight of a name, but no code path ever removed entries: request cleanup removed requests from queues but the queue objects and map entries persisted. An unauthenticated attacker could send requests for arbitrary function names to drive unbounded memory growth and crash the server.
- CVE-2026-82439 rated important by Apache
- Affects Apache Storm DRPC 3.0.0 before 3.1.0
- Function-name queue map entries never freed
- Unauthenticated remote denial of service via memory exhaustion
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82439 | Unauthenticated Memory Exhaustion in Apache Storm DRPC Server | 9.8 | — |
From the original article
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm DRPC (org. apache. storm:storm-server) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.