Description

Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation. `storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port. The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration. Mitigation Upgrade to 3.1.0, where frames are decoded only after the handshake completes. Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T15:17:10.620Z",
  "pubdate": "2026-09-14T15:17:10.620Z",
  "executiveSummary": "A memory exhaustion vulnerability exists in Apache Storm's Netty messaging implementation, allowing unauthenticated remote attackers to trigger large, arbitrary memory allocations.\nThe flaw stems from the Netty message decoder processing frames prior to the completion of SASL authentication. By crafting a frame with a malicious length field, an attacker can force the worker process to allocate significant heap memory based on that field.\nThis vulnerability is categorized as a Denial of Service (DoS) risk. The impact ranges from transient garbage collection pressure to sustained worker process termination due to OutOfMemory (OOM) errors.\nExploitation requires only TCP reachability to a worker slot port. Because the decoder executes before authentication handlers, no credentials are required to initiate the attack.\nRisk is significant for deployments exposed to untrusted networks, as the architecture fails to validate frame length metadata before establishing trust via handshake protocols.\nUsers are advised to upgrade to version 3.1.0 or apply network-level restrictions to prevent unauthorized access to worker slot ports.",
  "technicalDetails": "The vulnerability resides within the Netty pipeline configuration of the Apache Storm messaging layer. In affected versions, the custom message decoder component is positioned ahead of the SASL authentication handlers. This architectural misplacement causes the decoder to parse incoming TCP frames and process frame metadata before any authentication or authorization checks occur.\nThe root cause is the decoder's reliance on a length field provided within the frame header to pre-allocate memory buffers. Specifically, the decoder reads the length field from the raw TCP stream and immediately executes a memory allocation operation to accommodate the anticipated payload size. Because this happens before the handshake, an attacker can send a single, malicious frame containing a high value in the length field, forcing the JVM to allocate a large buffer.\nThe attack flow follows a simple progression: 1) The attacker establishes a TCP connection to an exposed worker slot port. 2) The attacker transmits a crafted frame header where the length field is set to a large value (up to the limits allowed by the JVM heap). 3) The worker process, upon receiving the frame, reads the length field and attempts to allocate the corresponding memory buffer. 4) By sending multiple such requests or a single request exceeding available heap space, the attacker induces either severe garbage collection thrashing or an OOM condition, resulting in process instability or termination.\nBecause the 'storm.messaging.netty.authentication' setting is disabled by default, and even when enabled, the architectural order of operations remains unchanged, the vulnerability is effectively exploitable in default configurations. The lack of prior validation or rate limiting on buffer allocation allows unauthenticated, remote actors to deplete system resources.\nThe impact of the exhaustion depends on the specific worker heap configuration. In a standard configuration (e.g., 768 MB), a single large allocation can be sufficient to destabilize the process. The vulnerability is present in versions prior to 3.1.0, where the message decoding pipeline has been modified to enforce deferred decoding until after a successful SASL handshake."
}