CVE-2026-82435: Apache Storm Worker DOS Vulnerability

CVE-2026-82435 Overview

CVE-2026-82435 is a pre-authentication memory allocation vulnerability in Apache Storm worker processes. The Netty message decoder is installed ahead of the Simple Authentication and Security Layer (SASL) handlers in the pipeline. It processes frames before any authentication takes place. An attacker with TCP reachability to a worker slot port can send a single crafted frame whose length field drives a large buffer allocation. Because storm.messaging.netty.authentication defaults to false, no credentials are required. The flaw is tracked under [CWE-789: Memory Allocation with Excessive Size Value].

Critical Impact
An unauthenticated remote attacker can trigger oversized buffer allocations on Apache Storm worker processes, causing worker loss or garbage-collection pressure with a single TCP frame.

Affected Products

Apache Storm versions prior to 3.1.0
Apache Storm deployments using default storm.messaging.netty.authentication=false configuration
Apache Storm worker processes exposing Netty slot ports

Discovery Timeline

2026-09-14 - CVE-2026-82435 published to NVD
2026-09-14 - Last updated in NVD database
Credit: The Apache Software Foundation, found using Claude agents to study open-source project security, validated and reported by Apache Storm

Technical Details for CVE-2026-82435

Vulnerability Analysis

Apache Storm worker processes use a Netty-based messaging pipeline for inter-worker communication. The message decoder sits ahead of the SASL authentication handlers in the pipeline order. This ordering allows the decoder to act on incoming frames before authentication is enforced.

The decoder reads a length field carried in each frame and allocates a buffer sized according to that value. An unauthenticated peer with TCP reachability to a worker slot port can send a frame declaring a large length. The worker then attempts to allocate a buffer matching the attacker-supplied size.

At the default 768 MB worker heap, the effect of a single malicious frame has not been precisely measured. Outcomes range from transient garbage-collection pressure to sustained worker loss depending on heap configuration and cluster load.

Root Cause

The root cause is incorrect pipeline ordering combined with unbounded trust in a client-controlled length field. The Netty decoder allocates memory based on a value from an unauthenticated frame, matching the [CWE-789] pattern of memory allocation with an excessive size value. The security control that would enforce authentication runs after the vulnerable decoder, so setting storm.messaging.netty.authentication=true does not close the pre-authentication attack surface in affected versions.

Attack Vector

The attacker requires only network reachability to a worker slot port. No credentials, user interaction, or prior access are required. A single TCP frame with a crafted length field is sufficient to trigger the oversized allocation. In deployments where worker ports are exposed beyond the cluster boundary, any network-adjacent attacker can invoke the condition against every reachable worker.

No verified proof-of-concept code is published. Refer to the Apache Security Mailing List Post and the OpenWall OSS Security Update for advisory details.

Detection Methods for CVE-2026-82435

Indicators of Compromise

Unexpected worker JVM restarts or OutOfMemoryError entries in Storm worker logs
Sudden spikes in heap usage or full garbage-collection pauses on worker nodes without a corresponding topology load change
Inbound TCP connections to worker slot ports originating from hosts outside the Storm cluster subnet
Netty decoder exceptions referencing allocation failures ahead of any SASL handshake

Detection Strategies

Monitor Storm worker JVM metrics for anomalous allocation patterns, GC pause frequency, and heap saturation events
Correlate worker crashes with recent inbound connections to Netty messaging ports from unauthorized source IP addresses
Alert on any TCP session to a worker slot port that does not complete a subsequent SASL handshake
Baseline normal inter-worker traffic patterns and flag deviations in frame size distribution

Monitoring Recommendations

Ingest Storm worker logs, JVM metrics, and network flow data into a centralized analytics platform for cross-source correlation
Configure alerts on repeated worker process termination within short time windows
Track connection attempts to worker ports from outside allowlisted cluster address ranges
Review firewall and security group logs for external access attempts targeting the Netty messaging port range

How to Mitigate CVE-2026-82435

Immediate Actions Required

Upgrade Apache Storm to version 3.1.0, where frames are decoded only after the SASL handshake completes
Restrict worker slot ports so they are reachable only from within the Storm cluster, consistent with the documented security model
Enable storm.messaging.netty.authentication on deployments that permit it, recognizing this does not fully mitigate on affected versions but reduces exposure post-upgrade
Inventory all Storm clusters and confirm none expose worker ports to untrusted networks

Patch Information

Apache Storm 3.1.0 corrects the pipeline ordering so that the Netty message decoder runs only after the SASL handshake completes. This ensures unauthenticated peers cannot drive buffer allocations. Consult the Apache Security Mailing List Post for full advisory content and upgrade guidance.

Workarounds

Place worker slot ports behind network segmentation, firewalls, or security groups that only permit traffic from other cluster nodes
Deploy host-based firewall rules on Storm worker nodes limiting inbound connections to known cluster peers
Where operationally feasible, enable storm.messaging.netty.authentication as an additional layer once upgraded to 3.1.0
Audit cloud security groups and on-premise ACLs to confirm no Storm messaging ports are exposed to the public internet

bash

# Configuration example: enable Netty authentication in storm.yaml
storm.messaging.netty.authentication: true

# Example iptables rule restricting worker port range to the cluster subnet
# Adjust CLUSTER_CIDR and WORKER_PORT_RANGE to match your deployment
iptables -A INPUT -p tcp --dport 6700:6703 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6700:6703 -j DROP