VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 16 hours ago

CVE-2026-82435

Unknown No fix identified

Not yet in NVD's feed. The description, CVSS and CWE below come from the CVE Numbering Authority's own record, not from NVD analyst review. NVD's own page for this identifier may not exist yet.

Published yesterday. NVD backfills CPE data for days or weeks after publication, and OSV and the exploit indexes lag too. Scope and status here may change.

Description

Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation. storm.messaging.netty.authentication defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port. The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration. Mitigation Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable storm.messaging.netty.authentication where the deployment permits it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CWE-789

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited, which is not the same as ruling it out.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS not scored

Waratek Defense Posture

No fix identified

In RASP's scope, but nothing published names a fix and nothing published shows an exploit. Neither of the two things VRT can act on exists, which is a claim about the available evidence, not about the vulnerability.

  • Protection none
  • Action not-needed
  • Review automated upstream-data
  • Record active
Decided by no-exploit : With no fix path, a public exploit, or a CISA record of one
Finding Resolved from QUEUED-FOR-REVIEW: this CVE affects a known product, but nothing published names a fix and nothing published shows an exploit. That is a statement about the evidence, not about the defect — it does not mean the vulnerability is unimportant or unreachable, only that neither of the two things VRT can act on exists.

References

URLTags
https://lists.apache.org/thread/wqfy7qb8c76f4c3wr2w6bhoz62vcnpb7 vendor-advisory

Timeline

Published 2026-09-14 Last modified 2026-09-14
Published2026-09-14By the CVE Program.
NVD record modified2026-09-14NVD's own last-modified date for this record.