Storm vulnerabilities

1 known vulnerability in Storm from Apache. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Apache Storm Client: Deserialization of Untrusted Data

  CVE-2026-35337Apr 13, 2026ApacheEPSS 1.03%

  Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.read