Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for Apache Storm DRPC by Apache Software Foundation
CVE-2026-82439 (GCVE-0-2026-82439)
Vulnerability from nvd – Published: 2026-09-14 14:00 – Updated: 2026-09-14 19:51
VLAI
EPSS
VEX
Title
Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Summary
Description
The DRPC server kept a map from function name to request queue and created an entry the first time a
function name was seen. No code path ever removed an entry: request cleanup removed the request from its
queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of
the process.
Function names come from the client and are not constrained to functions any topology has registered, so the
number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and
each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are
required to reach the endpoint.
The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC
server exhausts its heap.
Mitigation
Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it.
Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can
reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:51 UTC
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/7sgzvv5lzz93jn6vy… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Storm DRPC |
Affected:
3.0.0 , < 3.1.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-14T14:13:45.333Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/13/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:51:03.619338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:51:25.795Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.storm:storm-server",
"product": "Apache Storm DRPC",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The ASF using Claude Agents"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003eDescription\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe DRPC server kept a map from function name to request queue and created an entry the first time a\u003cbr\u003efunction name was seen. No code path ever removed an entry: request cleanup removed the request from its\u003cbr\u003equeue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of\u003cbr\u003ethe process.\u003cbr\u003e\u003cbr\u003eFunction names come from the client and are not constrained to functions any topology has registered, so the\u003cbr\u003enumber of retained entries is bounded only by the number of distinct names an attacker chooses to send, and\u003cbr\u003eeach retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are\u003cbr\u003erequired to reach the endpoint.\u003cbr\u003e\u003cbr\u003eThe retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC\u003cbr\u003eserver exhausts its heap.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eMitigation\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eUpgrade to 3.1.0, where a function\u0027s queue is removed once nothing is waiting in it.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can\u003cbr\u003ereach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eCredit\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\u003cbr\u003e"
}
],
"value": "Description\n\nThe DRPC server kept a map from function name to request queue and created an entry the first time a\nfunction name was seen. No code path ever removed an entry: request cleanup removed the request from its\nqueue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of\nthe process.\n\nFunction names come from the client and are not constrained to functions any topology has registered, so the\nnumber of retained entries is bounded only by the number of distinct names an attacker chooses to send, and\neach retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are\nrequired to reach the endpoint.\n\nThe retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC\nserver exhausts its heap.\n\nMitigation\n\nUpgrade to 3.1.0, where a function\u0027s queue is removed once nothing is waiting in it.\n\nUsers who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can\nreach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:00:09.318Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/7sgzvv5lzz93jn6vy74qfk105bhmkrzs"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-82439",
"datePublished": "2026-09-14T14:00:09.318Z",
"dateReserved": "2026-08-29T10:40:16.365Z",
"dateUpdated": "2026-09-14T19:51:25.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82439 (GCVE-0-2026-82439)
Vulnerability from cvelistv5 – Published: 2026-09-14 14:00 – Updated: 2026-09-14 19:51
VLAI
EPSS
VEX
Title
Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Summary
Description
The DRPC server kept a map from function name to request queue and created an entry the first time a
function name was seen. No code path ever removed an entry: request cleanup removed the request from its
queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of
the process.
Function names come from the client and are not constrained to functions any topology has registered, so the
number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and
each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are
required to reach the endpoint.
The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC
server exhausts its heap.
Mitigation
Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it.
Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can
reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:51 UTC
CWE
- CWE-770 - Allocation of resources without limits or throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/7sgzvv5lzz93jn6vy… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Storm DRPC |
Affected:
3.0.0 , < 3.1.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-14T14:13:45.333Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/13/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:51:03.619338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:51:25.795Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.storm:storm-server",
"product": "Apache Storm DRPC",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The ASF using Claude Agents"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003eDescription\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe DRPC server kept a map from function name to request queue and created an entry the first time a\u003cbr\u003efunction name was seen. No code path ever removed an entry: request cleanup removed the request from its\u003cbr\u003equeue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of\u003cbr\u003ethe process.\u003cbr\u003e\u003cbr\u003eFunction names come from the client and are not constrained to functions any topology has registered, so the\u003cbr\u003enumber of retained entries is bounded only by the number of distinct names an attacker chooses to send, and\u003cbr\u003eeach retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are\u003cbr\u003erequired to reach the endpoint.\u003cbr\u003e\u003cbr\u003eThe retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC\u003cbr\u003eserver exhausts its heap.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eMitigation\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eUpgrade to 3.1.0, where a function\u0027s queue is removed once nothing is waiting in it.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can\u003cbr\u003ereach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eCredit\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.\u003cbr\u003e"
}
],
"value": "Description\n\nThe DRPC server kept a map from function name to request queue and created an entry the first time a\nfunction name was seen. No code path ever removed an entry: request cleanup removed the request from its\nqueue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of\nthe process.\n\nFunction names come from the client and are not constrained to functions any topology has registered, so the\nnumber of retained entries is bounded only by the number of distinct names an attacker chooses to send, and\neach retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are\nrequired to reach the endpoint.\n\nThe retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC\nserver exhausts its heap.\n\nMitigation\n\nUpgrade to 3.1.0, where a function\u0027s queue is removed once nothing is waiting in it.\n\nUsers who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can\nreach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.\n\nCredit\n\nThe ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of resources without limits or throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:00:09.318Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/7sgzvv5lzz93jn6vy74qfk105bhmkrzs"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-82439",
"datePublished": "2026-09-14T14:00:09.318Z",
"dateReserved": "2026-08-29T10:40:16.365Z",
"dateUpdated": "2026-09-14T19:51:25.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}