Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.storm:storm-server

8 known vulnerabilities (3 critical, 2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
3.1.0 (Sep 14, 2026): no advisory affects it
Newest unaffected release
3.1.0 (Sep 14, 2026), the latest release
Advisories
8 · 3 critical, 2 high, 3 medium
Dependents
9
Releases
27 since 2.0.0 (Apr 29, 2019)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82433Medium 6.5

    Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.

  • Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82434Critical 10.0

    Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82426Medium 6.5

    Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82439Critical 9.8

    Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-82441Critical 9.1

    Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.

  • CVE-2026-84179Medium 6.5

    Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

    Affected: from 3.0.0, fixed in 3.1.0.

    Fixed in 3.1.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 3.1.0, is not affected.