The Apache Storm DRPC server maintains a map from function names to request queues, creating entries for each new function name seen. These entries are never removed, even after requests are processed and queues drained, causing permanent retention of state. Because function names are client-controlled and unrestricted, an attacker can send numerous distinct names to cause unbounded growth of retained entries, leading to heap exhaustion. The default configuration does not require credentials to access the DRPC endpoint, increasing the risk. The vulnerability is addressed in Apache Storm version 3.1.0, which removes function queues once they are empty.

An attacker can cause a denial of service by exhausting the DRPC server's heap memory through sending many distinct function names, leading to resource exhaustion and potential service disruption. The lack of default authorization on the DRPC endpoint increases the attack surface, allowing unauthenticated attackers to exploit this vulnerability.

Upgrade Apache Storm DRPC to version 3.1.0 or later, where the function queues are removed once empty, preventing unbounded resource retention. For users unable to upgrade immediately, configure the 'drpc.authorizer' setting to restrict access to trusted principals only, and ensure DRPC ports are not accessible from untrusted networks.