CVE-2026-82436

The DefaultStateSerializer component in Apache Storm (specifically when using the Redis-backed state provider ) is vulnerable to arbitrary code execution. The root cause is that the component configures Kryo with class registration disabled and an instantiation strategy that constructs objects wi...

CVE-2026-82436

Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...

EUVD-2026-119926

Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party...