CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Unauthenticated DRPC requests to Apache Storm 3.0.0 cause unbounded memory growth in the function-name queue map, enabling DoS.
CVE-2026-82439 (severity: important) affects Apache Storm DRPC (storm-server) versions 3.0.0 before 3.1.0. The DRPC server maintained a map from function name to request queue, creating an entry on first sight of a name, but no code path ever removed entries: request cleanup removed requests from queues but the queue objects and map entries persisted. An unauthenticated attacker could send requests for arbitrary function names to drive unbounded memory growth and crash the server.
- CVE-2026-82439 rated important by Apache
- Affects Apache Storm DRPC 3.0.0 before 3.1.0
- Function-name queue map entries never freed
- Unauthenticated remote denial of service via memory exhaustion
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-82439 | Unauthenticated Memory Exhaustion in Apache Storm DRPC Server Apache Storm's DRPC server creates a queue entry the first time it sees a function name and never removes it, so retained state accumulates for the life of the process (CWE-770, allocation without limits). Because function names come from the client and are not constrained to functions any topology has registered, an attacker can drive unbounded heap growth simply by sending requests with many distinct function names. The drpc.authorizer setting is unset by default, so no credentials are required to reach the DRPC endpoint, and any party with network access to the DRPC ports can exhaust the server's heap and take it down — a denial of service whose effect is permanent rather than a transient load spike. Apache Storm deployments running DRPC servers on versions prior to 3.1.0 are affected. No public proof of concept or exploitation is known, the CVE is not in CISA's KEV catalog, and no CVSS score has been assigned yet. Do: Upgrade to Apache Storm 3.1.0, where a function's queue is removed once nothing is waiting in it. If you cannot upgrade immediately, configure drpc.authorizer so only trusted principals can reach the DRPC endpoints, and ensure the DRPC ports are not reachable from untrusted networks. Also review DRPC server heap usage and logs for unexplained growth from many distinct function names, which would indicate probing. | 9.8 | — |
| nichelikely hundreds to low thousands of DRPC-enabled Storm clusters, with only a subset having DRPC ports reachable by untrusted parties (clearly an estimate) |
Posted by Richard Zowalla on Sep 13 Severity: important Affected versions: - Apache Storm DRPC (org.apache.storm:storm-server) 3.0.0 before 3.1.0 Description: Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map entry remained for the...
This source does not provide full text. Read it at seclists.org.