CVE-2026-82439 Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
Unauthenticated attackers can cause permanent memory exhaustion in Apache Storm DRPC by sending unique function names, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82439?
CVE-2026-82439 is a critical denial of service vulnerability in Apache Storm DRPC, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Description
The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of the process.
Function names come from the client and are not constrained to functions any topology has registered, so the number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are required to reach the endpoint.
The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC server exhausts its heap.
Mitigation
Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it.
Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks.
Credit
The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.
Weakness: CWE-770
Which versions are affected by CVE-2026-82439?
How do I fix CVE-2026-82439?
No fix has been published for CVE-2026-82439 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-82439 being exploited?
There is no known exploitation of CVE-2026-82439 in the wild and no public exploit code.
Sources
Also known as GHSA-q5hq-8q75-r6f6.