CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.
Stories per day · 30 days
5 stories, newest first · one card per story
Stories tagged #storm
CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
Apache Storm Nimbus and Client expose ZooKeeper topology credentials to read-only users and logs, fixed in 3.1.0.
CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Apache Storm Nimbus and UI return unredacted daemon configuration, including ZooKeeper and keystore secrets, to authorized users.
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus blobstore authorization bypass via rebalance configuration overrides, fixed in 3.1.0.
CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location
Apache Storm Nimbus 3.0.0 before 3.1.0 allows arbitrary server-side file read via unvalidated uploadedJarLocation in submitTopology calls.