You are viewing a plain text version of this content. The canonical link for it is here.
- [ANNOUNCE] Apache Storm 3.1.0 released - posted by Rui Abreu <ra...@apache.org> on 2026/09/12 22:54:49 UTC, 0 replies.
- unsubscribe - posted by Calvin Chen <pi...@hotmail.com> on 2026/09/13 05:05:22 UTC, 0 replies.
- CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:23 UTC, 0 replies.
- CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:37 UTC, 0 replies.
- CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:45 UTC, 0 replies.
- CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:55 UTC, 0 replies.
- CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:02 UTC, 0 replies.
- CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:10 UTC, 0 replies.
- CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:16 UTC, 0 replies.
- CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:22 UTC, 0 replies.
- CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:30 UTC, 0 replies.
- CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:47:02 UTC, 0 replies.
- CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:00 UTC, 0 replies.
- CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:07 UTC, 0 replies.
- CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:14 UTC, 0 replies.
- CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:42 UTC, 0 replies.
- CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:49:05 UTC, 0 replies.
- Unsubscribe - posted by Manikandan Ramakrishnan <ma...@gmail.com> on 2026/09/13 16:50:54 UTC, 0 replies.
- Fwd: Upgrades - posted by Ashish Vaidya <va...@gmail.com> on 2026/09/24 06:21:29 UTC, 0 replies.
- Issue with zookeeper connection loss killing supervisor - posted by Jonas Krauss <jk...@gmail.com> on 2026/09/30 05:27:32 UTC, 0 replies.