An unauthenticated remote denial of service vulnerability in Apache Storm DRPC, caused by improper memory management, poses a critical risk to system availability.

This vulnerability is a resource exhaustion flaw (CWE-770) where the DRPC server fails to remove entries from an internal map when processing function names provided by the client. Because the drpc.authorizer is unset by default, an unauthenticated attacker can exploit this to exhaust the server heap memory.

Successful exploitation results in a complete denial of service for the affected DRPC server, causing significant operational downtime and potential service disruption for dependent topologies. With a CVSS score of 9.8, this critical vulnerability reflects the ease of exploitation and the total impact on system availability, necessitating immediate remediation to maintain business continuity.

Immediate Action: Upgrade Apache Storm DRPC to version 3.1.0 or later to implement the corrected queue removal logic.

Proactive Monitoring: Monitor server heap usage metrics and review network access logs for anomalous, high-frequency requests to DRPC endpoints containing varied or randomized function names.

Compensating Controls: If upgrading is not immediately feasible, configure the drpc.authorizer to restrict access to trusted principals and ensure that DRPC ports are isolated from untrusted networks via firewall rules.

Public Exploit Available: No (exploit_available: false)

Given the critical nature of this vulnerability and the lack of default authentication, organizations running Apache Storm DRPC must prioritize patching to version 3.1.0. If an immediate update is not possible, enforcing network-level access controls and enabling the drpc.authorizer are essential to mitigate the risk of service disruption.