CVE-2026-82435: Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline a

A vulnerability in Apache Storm's Netty message decoder allows an unauthenticated attacker with network access to a worker port to cause large memory allocations before authentication is checked. The decoder processes incoming frames before SASL authentication handlers (a protocol that verifies user identity) run, and since authentication is disabled by default, an attacker only needs TCP connectivity to trigger the issue.