Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.storm:storm-client

6 known vulnerabilities (3 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
3.1.0 (Sep 11, 2026): no advisory affects it
Newest unaffected release
3.1.0 (Sep 11, 2026), the latest release
Advisories
6 · 3 critical, 2 high, 1 medium
Dependents
34
Releases
27 since 2.0.0 (Apr 29, 2019)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 11, 2026, 3 days before disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82431Critical 9.8

    Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 11, 2026, 3 days before disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82434Critical 10.0

    Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 11, 2026, 3 days before disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82435Critical 9.8

    Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 11, 2026, 3 days before disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-41081Medium 6.5

    Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

    Affected: fixed in 2.8.7; fixed in 2.8.7.

    Fixed in 2.8.7 (released Apr 19, 2026, 8 days before disclosure).

    The latest release, 3.1.0, is not affected.

  • Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

    Affected: fixed in 2.8.6; fixed in 2.8.6.

    Fixed in 2.8.6 (released Apr 7, 2026, 6 days before disclosure).

    The latest release, 3.1.0, is not affected.