Apache Storm Client vulnerability allows deserialization of untrusted state store data
Original title: CVE-2026-82436: Apache Storm Client: Deserialization of Untrusted Data from the State Store
Apache Storm Client before 3.1.0 deserializes untrusted data from state store with disabled Kryo class registration, enabling arbitrary code execution.
DefaultStateSerializer used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors. A party able to write to the state store could trigger deserialization. The issue was reported on November 8 with important severity.
- Affects Apache Storm Client (org.apache.storm:storm-client) 3.0.0 before 3.1.0
- Description: Deserialization of untrusted data from the State Store
- Severity: important
Impact: deserialization of untrusted data from state store
- 1.Upgrade to Apache Storm 3.1.0 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-82436 | Deserialization of Untrusted Data in Apache Storm Redis State Provider | — | — |
From the original article
Posted by Richard Zowalla on Nov 08 Severity: important Affected versions: - Apache Storm Client (org. apache. storm:storm-client) 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.