CVE-2021-40865 — CVE-2021-40865

CVE-2021-40865

CRITICAL · CVSS 9.8

EPSS exploitation probability: 0%

Published 2021-10-25T13:15:08.140 · Last modified 2026-06-17T04:07:33.820

Summary

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Affected products

apache — storm

Does this affect you?

Add your gear to cvedb and we'll alert you only when apache ships something exploited.

Check my exposure →

References

NVD entry
CVE.org record

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.