https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:30:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-368245 EUVD-2026-368245 https://cve.radiocsirt.org/vuln/euvd-2026-368245 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82435 <p>Description</p> <p>The worker&#39;s Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation.</p> <p>`storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port.</p> <p>The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where frames are decoded only after the handshake completes.</p> <p>Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> <p>Description</p> <p>The worker&#39;s Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation.</p> <p>`storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port.</p> <p>The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where frames are decoded only after the handshake completes.</p> <p>Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-82435 https://cve.radiocsirt.org/vuln/ghsa-3mpj-29mm-p7wr <p>Description</p> <p>The worker&#39;s Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation.</p> <p>`storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port.</p> <p>The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where frames are decoded only after the handshake completes.</p> <p>Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> <p>Description</p> <p>The worker&#39;s Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation.</p> <p>`storm.messaging.netty.authentication` defaults to false, and the decoder runs before the handler that enforces it in any case, so no credentials are required. The attacker needs only TCP reachability to a worker port.</p> <p>The effect of a single frame at the default 768 MB worker heap has not been measured to distinguish sustained worker loss from transient garbage-collection pressure. The severity assigned to this advisory reflects the more conservative reading; consumers who require a precise figure should test against their own worker heap configuration.</p> <p>Mitigation</p> <p>Upgrade to 3.1.0, where frames are decoded only after the handshake completes.</p> <p>Users who cannot upgrade immediately should ensure that worker slot ports are reachable only from within the cluster, as the security model already recommends, and should enable `storm.messaging.netty.authentication` where the deployment permits it.</p> <p>Credit</p> <p>The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.</p> https://cve.radiocsirt.org/vuln/ghsa-3mpj-29mm-p7wr