CVE-2026-82439 Details
Description
Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of the process. Function names come from the client and are not constrained to functions any topology has registered, so the number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are required to reach the endpoint. The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC server exhausts its heap. Mitigation Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it. Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
A memory growth vulnerability has been identified in the Apache Storm DRPC server, specifically in versions 3.0.0 prior to 3.1.0. The issue arises because the DRPC server maintains a map of function names to request queues. Once a function name is received, an entry is created and never removed. Although request cleanup processes remove individual requests from their queues, the corresponding queue objects and map entries persist for the duration of the server process. This unbounded retention can lead to significant memory consumption, as the accumulated entries eventually exhaust the server's heap. The vulnerability is exacerbated by the fact that function names are not restricted to those registered in any topology, allowing an attacker to send a variety of names to increase the memory load. Additionally, the 'drpc.authorizer' is disabled by default, meaning no credentials are needed to access the endpoint.
Users are advised to upgrade to Apache Storm version 3.1.0 or later, where this issue has been addressed. For those unable to upgrade immediately, it is recommended to configure the 'drpc.authorizer' to allow only trusted principals access to the DRPC endpoints, and to ensure that the DRPC ports are not accessible from untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/09/13/18 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread/7sgzvv5lzz93jn6vy74qfk105bhmkrzs | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Storm DRPC | >= 3.0.0, < 3.1.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | CVE Modified | CVE |
| Sep 14, 2026 | New CVE Received | [email protected] |