Apache Storm Worker is vulnerable to an unauthenticated memory allocation flaw that can lead to significant service disruption and potential system-wide impact.

The Netty message decoder processes incoming frames before SASL authentication is enforced, allowing an unauthenticated attacker to trigger large memory buffer allocations based on frame length fields. This vulnerability (CWE-789) enables an attacker with TCP reachability to a worker slot port to cause resource exhaustion.

The CVSS score of 9.8 reflects the high severity of this issue, as it allows for unauthenticated remote exploitation with minimal effort. Successful exploitation could lead to sustained worker loss or significant service degradation, resulting in downtime and operational disruption for critical data processing pipelines.

Immediate Action: Upgrade to Apache Storm Worker version 3.1.0, which ensures that frames are decoded only after the authentication handshake is successfully completed.

Proactive Monitoring: Monitor cluster worker nodes for anomalous memory usage, unexpected garbage collection spikes, or sudden service crashes that may indicate exploitation attempts.

Compensating Controls: If an immediate upgrade is not feasible, restrict network access to worker slot ports to trusted internal cluster traffic only and consider enabling the storm.messaging.netty.authentication configuration setting.

Public Exploit Available: No

Given the critical CVSS severity and the ease of exploitation, organizations should prioritize patching to version 3.1.0 as soon as possible. Restricting network access to worker ports serves as a necessary interim measure, but it does not remove the underlying vulnerability. Security teams must ensure that all worker nodes are updated to eliminate the risk of remote service disruption.