Serialization Flaw in Apache Storm Affects Redis State Provider

CVE-2026-82436

What is CVE-2026-82436?

A serialization flaw exists in the DefaultStateSerializer of Apache Storm, specifically in its configuration for persisting and restoring stateful bolt checkpoints. By default, class registration is disabled for Kryo, allowing unauthorized parties with write access to the topology's keyspace in a Redis-backed state store to inject a serialized object graph. This could lead to arbitrary code execution within the worker JVM during the restoration process. It is crucial to ensure that only registered classes are utilized in the state serializer to mitigate this risk. Upgrading to version 3.1.0 or later is recommended, but users should be aware of potential migration challenges for existing state checkpoints.

References