CVE-2026-82435

Apache Storm's Netty messaging server (MessageDecoder.decode) reads a 4-byte length field from an inbound frame and, once that many bytes have accumulated, allocates a byte array of that declared size to hold the SASL handshake token, a BackPressureStatus frame, or a task-message data frame -- with no upper bound on the declared length and no requirement that the peer has completed SASL authentication first. A peer with TCP reachability to a worker's Netty messaging port can declare an arbitrarily large length (up to ~2 GiB) in any of these frame types and drive the worker to buffer and allocate a matching amount of memory before any credential is checked, causing memory exhaustion / denial of service (CWE-789).