Description DefaultStateSerializer, used to persist and restore stateful bolt checkpoints, configured Kryo with class
Source GCVE Database
Not known to be exploited : upgrade to 3.1.0 soon.
Data as of 9 Nov 2026, 13:21 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in 3.1.0
Exploitation evidence
Disclosed: evidence found.
CVE published 9 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 9 Nov 2026.
What to do
Upgrade Apache Storm Client and org.apache.storm/storm-client to 3.1.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Apache Storm Clientorg.apache.storm:storm-client | Affected
| Fixed in
|
Mavenorg.apache.storm/storm-clientpkg:maven/org.apache.storm/storm-clientOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade Apache Storm to version 3.1.0 or later, where the DefaultStateSerializer enforces class registration, preventing arbitrary code execution via deserialization. Be aware that upgrading may require a migration step because checkpoints created by affected versions might fail to restore. If immediate upgrade is not feasible, restrict network and credential access to the Redis-backed state store to only trusted cluster components to prevent unauthorized write access.
Description
The DefaultStateSerializer component in Apache Storm, used for persisting and restoring stateful bolt checkpoints with a Redis-backed state provider, improperly configures Kryo serialization to allow deserialization of untrusted data without class registration. This enables an attacker with write access to the state store keyspace to inject serialized objects that execute arbitrary code in the worker JVM during state restoration. The vulnerability requires Redis-backed state usage and write privileges to the state store, which is a data-plane privilege distinct from code execution rights. Apache Storm 3.1.0 addresses this by enforcing class registration in the serializer, but upgrading may require migration due to changes in checkpoint restoration behavior.