# CVE-2026-82435: Apache Storm Netty decoder memory exhaustion before authentication

Source: https://junglewise.ai/threats/cve-2026-82435-apache-storm-netty-decoder-memory-exhaustion-before  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82435 · Severity: critical · CVSS 9.8 · Published 2026-09-14

Apache Storm is a distributed stream processing platform used for real-time data processing in enterprise environments. An unauthenticated attacker with network access to a Storm worker port can send a specially crafted frame that causes the message decoder to allocate large buffers, exhausting worker memory and causing service disruption or worker node failure. The vulnerability exists because authentication checks occur after message decoding in the network pipeline.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82435 being exploited in the wild.

**How severe is CVE-2026-82435?** Critical severity, with a CVSS score of 9.8, published 14 September 2026.

**Which products and versions are affected?** Apache Storm before 3.1.0.

**Is there a fix for CVE-2026-82435?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82435 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82435?** Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a pre-authentication denial-of-service in Apache Storm's Netty message decoder. The decoder processes inbound frames before SASL authentication handlers are invoked and allocates buffers based on a length field in the frame header, allowing an unauthenticated remote peer to trigger unbounded memory allocation. No credentials are required as `storm.messaging.netty.authentication` defaults to false. The attack requires only TCP reachability to a worker slot port. An attacker can send a single malformed frame with a large length field to force buffer allocation up to the worker heap limit, causing memory exhaustion and worker loss or severe garbage-collection degradation. The vulnerability was fixed in version 3.1.0 by deferring frame decoding until after handshake completion.

## Affected products

- Apache Storm before 3.1.0

## Timeline

- 2026-09-14: disclosed

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/wqfy7qb8c76f4c3wr2w6bhoz62vcnpb7](https://lists.apache.org/thread/wqfy7qb8c76f4c3wr2w6bhoz62vcnpb7)

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)