Security Resilience

CVE-2026-82439

DoS

DoS
Published
14 September 2026
Modified
14 September 2026
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0034 26th percentile
Risk Priority 71 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-82439 is a critical-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Apache Storm (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Exhaustion Flood (T1499.001); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and AC-7 (Unsuccessful Logon Attempts) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue,…

more

and the shutdown path drained queues, but the queue object and its map entry remained for the life of the process. Function names come from the client and are not constrained to functions any topology has registered, so the number of retained entries is bounded only by the number of distinct names an attacker chooses to send, and each retained entry holds the name itself. `drpc.authorizer` is unset by default, so no credentials are required to reach the endpoint. The retained state is permanent rather than a transient load spike, so the effect accumulates until the DRPC server exhausts its heap. Mitigation Upgrade to 3.1.0, where a function's queue is removed once nothing is waiting in it. Users who cannot upgrade immediately should configure `drpc.authorizer` so that only trusted principals can reach the DRPC endpoints, and should ensure the DRPC ports are not reachable from untrusted networks. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CWE(s)
CWE-770

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499.001 OS Exhaustion Flood Impact
Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS).
attack.mitre.org →
T1499.002 Service Exhaustion Flood Impact
Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).
attack.mitre.org →
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-36378Shared CWE-770
CVE-2025-37166Shared CWE-770
CVE-2026-54225Shared CWE-770
CVE-2026-40881Shared CWE-770
CVE-2025-22484Shared CWE-770
CVE-2023-5072Shared CWE-770
CVE-2025-30261Shared CWE-770
CVE-2026-30946Shared CWE-770
CVE-2025-21525Shared CWE-770
CVE-2024-39474Shared CWE-770

Affected Assets

Apache
Storm
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-10 Concurrent Session Control partial match

Directly enforces a hard limit on concurrent sessions, structurally preventing unbounded resource allocation.

AC-7 Unsuccessful Logon Attempts partial match

Imposes a limit on consecutive invalid attempts, preventing one specific class of unbounded resource consumption.

SC-5 Denial-of-service Protection partial match

Reduces impact of resulting DoS events without preventing the underlying lack of allocation limits.

SC-6 Resource Availability partial match

Requires explicit allocation of resources by priority or quota, directly stopping unlimited allocation.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-04 partial match
blocks

Monitoring capacity and taking action to maintain availability directly reduces unchecked resource allocation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248552 OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770
  • V-248553 OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. blocks CWE-770
Oracle Linux 9 (2 rules)
  • V-271710 OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. blocks CWE-770
  • V-271709 OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770
RHEL 8 (1 rule)
  • V-230244 RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770

References