EUVD-2026-77488
GHSA-q5hq-8q75-r6f6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable by default with no auth (PR:N, AV:N, AC:L); impact is strictly heap exhaustion DoS (A:H), no confidentiality or integrity effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Unauthenticated remote attackers can exhaust the heap of the Apache Storm DRPC server by sending requests with arbitrarily many distinct function names, causing a permanent, unbounded memory leak that accumulates until the process is killed by OOM. Affected is org.apache.storm:storm-server versions 3.0.0 through 3.0.x; version 3.1.0 is the fix release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the DRPC server port (default 3772 for RPC, 3773 for HTTP). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No NVD CVSS vector was provided; the reporter assigned severity 'important'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Storm 3.1.0, which removes a function's request-queue map entry once no requests remain in it, bounding memory to active workload rather than cumulative distinct names. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache Storm deployments running versions 3.0.0 through 3.0.x and determine whether DRPC services are network-accessible; restrict DRPC endpoints to trusted sources only through firewall or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today