Executive brief
Apache Storm is a distributed stream processing platform used for real-time data processing in enterprise environments. An unauthenticated attacker with network access to a Storm worker port can send a specially crafted frame that causes the message decoder to allocate large buffers, exhausting worker memory and causing service disruption or worker node failure. The vulnerability exists because authentication checks occur after message decoding in the network pipeline.
Technical details
The vulnerability is a pre-authentication denial-of-service in Apache Storm's Netty message decoder. The decoder processes inbound frames before SASL authentication handlers are invoked and allocates buffers based on a length field in the frame header, allowing an unauthenticated remote peer to trigger unbounded memory allocation. No credentials are required as `storm.messaging.netty.authentication` defaults to false. The attack requires only TCP reachability to a worker slot port. An attacker can send a single malformed frame with a large length field to force buffer allocation up to the worker heap limit, causing memory exhaustion and worker loss or severe garbage-collection degradation. The vulnerability was fixed in version 3.1.0 by deferring frame decoding until after handshake completion.
Affected products
- Apache Storm before 3.1.0
Timeline
- 2026-09-14: disclosed