CVE-2021-40865: Apache Storm

Critical severity, CVSS 9.8. EPSS: 64.2% chance of exploitation in the next 30 days.

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Affected products

• Apache Storm: from 1.0.0, before 1.2.4 (fixed in 1.2.4); from 2.1.0, before 2.1.1 (fixed in 2.1.1); from 2.2.0, before 2.2.1 (fixed in 2.2.1)

Published 2021-10-25. Last modified 2026-06-17.