CVE-2026-82435

Apache Storm 's worker Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline, causing it to allocate buffers based on a length field carried in incoming frames before any authentication occurs. Because storm.messaging.netty.authentication defaults to false ,...