CVE-2026-82439 Overview
CVE-2026-82439 is an unbounded resource allocation vulnerability in the Apache Storm Distributed Remote Procedure Call (DRPC) server. The server maintains an internal map from function name to request queue, creating a new entry the first time a function name is seen. No code path removes these entries during runtime, allowing state to accumulate for the life of the process. Because drpc.authorizer is unset by default, an unauthenticated remote attacker can submit arbitrary function names to exhaust the DRPC server heap. The flaw is classified under CWE-770: Allocation of Resources Without Limits or Throttling.
Critical Impact
An unauthenticated remote attacker can trigger permanent heap exhaustion in the Apache Storm DRPC server by sending requests with arbitrary function names.
Affected Products
- Apache Storm DRPC server versions prior to 3.1.0
- Deployments running with the default configuration where drpc.authorizer is unset
- Any topology exposing DRPC endpoints to untrusted networks
Discovery Timeline
- 2026-09-14 - CVE-2026-82439 published to the National Vulnerability Database
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-82439
Vulnerability Analysis
The Apache Storm DRPC server processes remote procedure call requests routed by function name. Internally, the server keeps a map that associates each function name with a request queue. When a client submits a request naming a function the server has not yet seen, the server creates a new queue entry and stores the function name string.
Request cleanup removes individual requests from their queue, and the shutdown path drains queues at process exit. Neither path removes the queue object or its map entry. The retained state persists for the entire lifetime of the process. This is permanent memory growth, not a transient load spike, so the effect accumulates until the Java Virtual Machine (JVM) heap is exhausted.
Function names originate from the client and are not validated against functions that any topology has actually registered. An attacker controls both the number and content of distinct names. Each retained entry holds the name string itself, so long attacker-chosen names inflate memory consumption per request.
Root Cause
The root cause is missing lifecycle management for entries in the function-name-to-queue map. The DRPC server treats map insertion as one-way and never garbage-collects queues that hold no waiting requests. Combined with the absence of any bound on the set of accepted function names, the design allows unbounded allocation driven entirely by client input.
Attack Vector
Exploitation requires only network reachability to the DRPC endpoint. Because drpc.authorizer is unset in the default configuration, no credentials are required. An attacker iterates through unique function names, submitting one request per name. Each request permanently adds an entry to the map. The attacker continues until the JVM exhausts its heap and the DRPC server becomes unresponsive or crashes. See the Apache mailing list discussion and the OpenWall OSS Security update for the vendor's technical description.
Detection Methods for CVE-2026-82439
Indicators of Compromise
- Sustained growth in DRPC server JVM heap usage that does not correlate with legitimate topology traffic
- High volume of DRPC requests referencing function names not registered by any deployed topology
- OutOfMemoryError entries in DRPC server logs preceded by elevated request rates from a single source
Detection Strategies
- Monitor DRPC server heap utilization over time and alert on monotonic growth patterns that do not recover after garbage collection
- Log the distribution of function names in DRPC requests and flag sources submitting large numbers of unique names
- Correlate network flow data to identify clients establishing repeated DRPC connections from untrusted network segments
Monitoring Recommendations
- Enable JVM heap and garbage collection metrics on all DRPC server instances and forward them to a centralized monitoring platform
- Capture application logs from org.apache.storm.daemon.drpc and alert on unusual function-name cardinality
- Track connections to DRPC ports (default 3772 and 3773) and alert on traffic sourced from outside expected client subnets
How to Mitigate CVE-2026-82439
Immediate Actions Required
- Upgrade Apache Storm to version 3.1.0, which removes a function's queue once nothing is waiting in it
- Restrict network access to DRPC ports so that only trusted application hosts can reach the endpoints
- Audit existing DRPC server configurations to confirm whether drpc.authorizer is set and identify exposed instances
Patch Information
Apache Storm 3.1.0 contains the fix. The updated code removes a function's queue entry from the map once no requests are waiting on it, bounding retained state to concurrently active work. Operators should plan an upgrade window and validate topology compatibility against the 3.1.0 release notes.
Workarounds
- Configure drpc.authorizer to require authentication and restrict DRPC access to trusted principals only
- Place DRPC servers behind firewall rules or network segmentation that block traffic from untrusted networks
- Deploy rate limiting in front of DRPC endpoints to slow the accumulation of map entries while an upgrade is scheduled
# Configuration example: enforce authorization on DRPC endpoints
# Add the following to storm.yaml on each DRPC server
drpc.authorizer: "org.apache.storm.security.auth.authorizer.DRPCSimpleACLAuthorizer"
drpc.authorizer.acl.filename: "drpc-auth-acl.yaml"
drpc.authorizer.acl.strict: true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
