As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Apache Storm DRPC (Distributed Remote Procedure Call) server versions 3.0.0 before 3.1.0 contain a memory leak vulnerability where request queues accumulate indefinitely without cleanup. An unauthenticated attacker can trigger unbounded memory growth by repeatedly sending requests with varying function names, eventually causing denial of service through resource exhaustion.
Why it matters: Organizations running Apache Storm 3.0.0 for DRPC operations face availability risk from remote attackers who can exhaust server memory without credentials; upgrading to version 3.1.0 or later is required.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Apache Storm DRPC versions before 3.1.0 contain an unauthenticated vulnerability that allows unbounded memory growth because the server creates persistent map entries for function names without ever removing them. Request cleanup and shutdown operations fail to delete the queue objects and map entries, potentially exhausting available memory over time.
Why it matters: Organizations running Apache Storm DRPC 3.0.0 before 3.1.0 face denial of service risk from remote attackers who can trigger memory exhaustion without authentication; upgrade to version 3.1.0 or later immediately.
- Source published
- First seen by Cybersecurity Tracker