CVE-2026-82435

/// Technical description

Description

The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline

and acts on frames before any authentication has taken place. It allocated buffers sized from a

length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker

slot port could drive a large allocation.

`storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that

enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a

worker port.

The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish

sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory

reflects the more conservative reading; consumers who require a precise figure should test against their own

worker heap configuration.

Mitigation

Upgrade to 3.1.0, where frames are decoded only after the hands

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References