The vulnerability exists because the Netty message decoder in Apache Storm Worker runs before SASL authentication handlers in the pipeline, acting on frames from unauthenticated peers. It allocates buffers sized according to a length field in the frame, which can be manipulated to cause excessive memory allocation. Since `storm.messaging.netty.authentication` defaults to false and the decoder precedes the authentication handler, no credentials are required to exploit this. An attacker with TCP reachability to a worker slot port can send a single malicious frame to induce large memory allocations, potentially causing worker instability or denial of service. The default worker heap size is 768 MB, but the exact impact depends on the heap configuration. The issue is resolved in Apache Storm 3.1.0 by ensuring frames are decoded only after the handshake completes.

An attacker with TCP access to a worker slot port can cause excessive memory allocation on the worker by sending a single crafted frame, potentially leading to worker instability or denial of service due to memory pressure. No authentication is required to exploit this vulnerability. The severity depends on the worker heap size and configuration, with potential for transient or sustained worker loss.

Upgrade Apache Storm Worker to version 3.1.0 or later, where the vulnerability is fixed by decoding frames only after handshake completion. For users unable to upgrade immediately, restrict worker slot port access to internal cluster networks only, as recommended by the security model. Additionally, enable `storm.messaging.netty.authentication` if the deployment environment permits, to enforce authentication before frame decoding.