VULNERABILITY INTELLIGENCE

CVE-2021-40865

CVSS score9.8 CRITICAL

EPSS probability64.18%

CISA KEVNot currently listed

Published2021-10-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Weakness classification

security@apache.org: CWE-502
nvd@nist.gov: CWE-502

Primary references

security@apache.org — Mailing List, Vendor Advisory
security@apache.org — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory