CVE-2021-40865: Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
Summary
CVE-2021-40865: Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm. Affects org.apache.storm:storm across 3 version ranges.
>= 1.0.0, < 1.2.4
>= 2.1.0, < 2.1.1
>= 2.2.0, < 2.2.1
Fixed in 1.2.4, 2.1.1 or 2.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Storm is a distributed real-time computation system used for processing large volumes of data. It provides fault-tolerance, scalability, and guarantees data processing even in the event of failures. The vulnerability in Apache Storm allows for unsafe deserialization of untrusted data, which can lead to remote code execution. This vulnerability affects versions 1.x, 2.1.x, and 2.2.x of the Apache Storm package.
Vulnerability Detail
The vulnerability arises from an unsafe deserialization process in the worker services of the Apache Storm supervisor server. An attacker can exploit this vulnerability to execute arbitrary code remotely without authentication. This can result in a complete compromise of the affected system, leading to unauthorized access, data theft, or further network exploitation. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2021-40865. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.2.41.2.4 -
>= 2.1.0, < 2.1.12.1.1 -
>= 2.2.0, < 2.2.12.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the necessary upgrades as mentioned in the 'how_to_fix' section.
Conclusion
The Apache Storm package is vulnerable to a critical remote code execution vulnerability. To mitigate the risk, it is crucial to upgrade to the fixed versions mentioned in the 'how_to_fix' section. Failure to address this vulnerability may result in unauthorized access, data theft, or further network exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm →
FAQ
Apache Storm is a distributed real-time computation system used for processing large volumes of data. It provides fault-tolerance, scalability, and guarantees data processing even in the event of failures.
The vulnerability allows for remote code execution, which can lead to unauthorized access, data theft, or further network exploitation. It has a critical severity rating with a CVSS score of 9.8.
Versions 1.x, 2.1.x, and 2.2.x of Apache Storm are affected by this vulnerability.
To fix this vulnerability, users should upgrade their Apache Storm installations to the recommended fixed versions: 2.2.1 or 2.3.0 for 2.2.x, 2.1.1 for 2.1.x, and 1.2.4 for 1.x.
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.storm:storm.
