# CVE-2026-82439: Distributed RPC server memory exhaustion via unbounded request queue entries

Source: https://junglewise.ai/threats/cve-2026-82439-distributed-rpc-server-memory-exhaustion-via-unbounded-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82439 · Severity: critical · CVSS 9.8 · Published 2026-09-14

A Distributed RPC (DRPC) server component that lacks authentication by default retains request queue entries indefinitely, even after requests complete. An unauthenticated attacker can exploit this by sending requests with arbitrary function names, causing the server to accumulate queue entries until heap memory is exhausted, resulting in denial of service.

Technologies: [Apache Storm](https://junglewise.ai/threats/technologies/storm). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-82439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82439 being exploited in the wild.

**How severe is CVE-2026-82439?** Critical severity, with a CVSS score of 9.8, published 14 September 2026.

**Which products and versions are affected?** Apache Storm before 3.1.0.

**Is there a fix for CVE-2026-82439?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82439 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-82439?** Check whether you run Apache Storm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DRPC server maintains a map associating function names with request queues, creating entries on first sight of a function name. The vulnerability stems from a missing cleanup mechanism: while individual requests are removed from queues and queues are drained on shutdown, the queue objects and their map entries are never deleted during the process lifetime. Since function names originate from untrusted client input and are not validated against registered functions, an attacker can create unbounded entries by sending requests with distinct arbitrary names. No authentication is enforced by default (drpc.authorizer is unset), making the endpoint publicly reachable. This results in permanent memory accumulation that exhausts heap space, causing denial of service. Upgrade to version 3.1.0 or later resolves the issue by removing queue entries once they become empty.

## Affected products

- Apache Storm before 3.1.0

## Timeline

- 2026-09-14: disclosed: CVE-2026-82439 published

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://lists.apache.org/thread/7sgzvv5lzz93jn6vy74qfk105bhmkrzs](https://lists.apache.org/thread/7sgzvv5lzz93jn6vy74qfk105bhmkrzs)

## Related threats

- [Apache Storm Nimbus information disclosure in worker placement](https://junglewise.ai/threats/cve-2026-94125-nimbus-returns-the-worker-placement-of-every-topology-running-on)
- [Apache Storm Logviewer symlink traversal in worker logs](https://junglewise.ai/threats/cve-2026-124495-when-workers-run-as-the-topology-owner-the-logviewer-serves)
- [Apache Storm arbitrary class instantiation in scheduler](https://junglewise.ai/threats/cve-2026-82440-description-nimbus-instantiates-the-class-named-by-a-topology-s)
- [Apache Storm unsafe deserialization in state serialization](https://junglewise.ai/threats/cve-2026-82436-description-defaultstateserializer-used-to-persist-and-restore)
- [Apache Storm CORS misconfiguration allows credential-based data exposure](https://junglewise.ai/threats/cve-2026-82438-apache-storm-cors-misconfiguration-allows-credential-based-data)