🛡️ Security fixes in this release
Apache Storm 3.2.0 fixes three vulnerabilities. All users of earlier 3.x releases are encouraged to upgrade. Details, mitigations and credits are in the release announcement.
| CVE | Summary | Affected versions | Fixed in |
|---|---|---|---|
| CVE-2026-94125 | Supervisor page discloses worker placement of other users' topologies | 2.0.0 before 3.2.0 | #9095 |
| CVE-2026-124495 | Logviewer follows worker symlinks across topology ACLs | 3.0.0 before 3.2.0 | #9182 |
| CVE-2026-124496 | DRPC HTTP doAsUser bypasses the impersonation authorizer
| 3.0.0 before 3.2.0 | #9183 |
Credits: kta1kri (independent researcher) for CVE-2026-94125, and Javier García Herrera for CVE-2026-124495 and CVE-2026-124496.
Behaviour changes to read before upgrading: the Logviewer no longer follows symbolic links, and worker files must be direct children of a port directory (deeper paths now answer 404). DRPC and the UI deny a doAsUser request that has no authenticated user (401). The Storm 2.x line is end of life and receives no fix.
What's Changed
🛡️ Security Fixes
- Only list workers of readable topologies on the supervisor page by @rzo1 in #9095
- Apply the impersonation authorizer to DRPC requests by @rzo1 in #9183
- Serve only worker files that resolve inside the log root by @rzo1 in #9182
⚠️ Breaking Changes
- Remove deprecated NIMBUS_SUPERVISOR_TIMEOUT_SECS and defaults entry (#8994) by @Mohit20057 in #9170
- Remove deprecated BlowfishTupleSerializer (#8994) by @Mohit20057 in #9167
- Remove legacy ZooKeeper backpressure cluster state methods and config (#8994) by @Mohit20057 in #9168
- Remove obsolete deprecated client Config keys (#8994) by @Mohit20057 in #9169
🚀 New Features
- Fix the integration test cluster and window test expectations by @rzo1 in #9152
- Log at error level when the kafka spout gives up on a tuple; document max-retry give-up semantics by @L1nq0 in #9093
- Throw a typed exception for tuples with unknown task or stream ids and add a deserialization strict mode by @L1nq0 in #9094
- Add a Prometheus reporter for the V2 topology metrics by @jnioche in #9158
- Formally mark Pacemaker subsystem and configs for removal (#8994) by @Mohit20057 in #9171
- Add checkstyle auto-fix tooling by @sercuzz8 in #9017
- Fix the indentation the checkstyle auto-fix gets wrong by @sercuzz8 in #9178
- Restore two test annotations lost in the JUnit 5 migration by @sharanggupta in #9186
- Print PR upgrade notes in the generated release notes by @reiabreu in #9189
- Add an opt-in virtual threads flag for the Thrift server handler pools on Java 25 by @GGraziadei in #9097
- Add pluggable tuple tracing with an OpenTelemetry tracer by @dpol1 in #9154
- Classify surviving deprecated APIs in storm-server, external modules, and utilities (#8994) by @Mohit20057 in #9173
- Classify surviving deprecated storm-client APIs with forRemoval decisions (#8994) by @Mohit20057 in #9172
- Run the Zstd compression level round-trip test by @sharanggupta in #9194
- Call getLogHandler in ShellUtilsTest failure tests by @sharanggupta in #9251
🐛 Bug Fixes
- Drop unexpected Pacemaker frames instead of terminating the daemon; mark Pacemaker as deprecated by @rzo1 in #9084
- Make strict deserialization mode fatal for IOException-wrapped failures by @rzo1 in #9159
- Fix the worker-launcher build with gcc 15 and glibc 2.43 by @rzo1 in #9187
- Deliver upstream feedback to remote tasks and stop spurious "No remote destination available" warnings by @ErnestasVaiciukeviciusAdform in #9175
- Fix supervisor crash on transient ZK connection loss by @jkrauss82 in #9153
📦 Dependency Upgrades
- Bump uuid to 13.0.1 by @reiabreu in #9083
- build(deps): bump actions/setup-java from 6.0.0 to 6.0.1 by @dependabot[bot] in #9091
- Bump burnett01/rsync-deployments to 9.0.1 by @rzo1 in #9096
- Bump netty-tcnative.version from 2.0.82.Final to 2.0.84.Final by @dependabot[bot] in #9100
- Bump org.codehaus.mojo:build-helper-maven-plugin from 3.6.1 to 3.6.2 by @dependabot[bot] in #9106
- Bump bouncycastle.version from 1.85 to 1.86 by @dependabot[bot] in #9107
- Bump slf4j.version from 2.0.18 to 2.0.20 by @dependabot[bot] in #9108
- Bump org.apache.commons:commons-lang3 from 3.20.0 to 3.21.0 by @dependabot[bot] in #9111
- Bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 by @dependabot[bot] in #9112
- Bump org.codehaus.mojo:taglist-maven-plugin from 3.2.2 to 3.2.3 by @dependabot[bot] in #9114
- Bump org.codehaus.mojo:exec-maven-plugin from 3.6.3 to 3.6.4 by @dependabot[bot] in #9116
- Bump io.github.git-commit-id:git-commit-id-maven-plugin from 10.0.0 to 10.0.1 by @dependabot[bot] in #9119
- Bump com.puppycrawl.tools:checkstyle from 14.0.0 to 14.3.0 by @dependabot[bot] in #9139
- Bump org.yaml:snakeyaml from 2.6 to 2.7 by @dependabot[bot] in #9138
- Bump mockito.version from 5.23.0 to 5.24.0 by @dependabot[bot] in #9132
- Bump storm-webapp npm dependencies by @rzo1 in #9148
- Bump org.apache:apache parent from 39 to 40 by @rzo1 in #9149
- Bump iceberg from 1.11.0 to 1.12.0 by @rzo1 in #9150
- Bump surefire from 3.5.6 to 3.6.0 by @rzo1 in #9151
- build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #9162
- build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #9161
- build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #9160
- Bump postcss-selector-parser from 7.1.5 to 7.1.6 by @dependabot[bot] in #9164
- Bump joi from 18.2.5 to 18.2.9 by @dependabot[bot] in #9166
- Bump proxy-addr from 2.0.7 to 2.0.8 by @dependabot[bot] in #9165
- Bump source-map-js from 1.2.1 to 1.2.2 by @dependabot[bot] in #9163
- build(deps): bump burnett01/rsync-deployments from 9.0.1 to 9.0.2 by @dependabot[bot] in #9181
- Bump follow-redirects from 1.16.0 to 1.16.1 by @dependabot[bot] in #9185
- build(deps): bump actions/setup-python from 7.0.0 to 7.1.0 by @dependabot[bot] in #9191
- Bump serialize-javascript from 7.0.5 to 7.1.4 by @dependabot[bot] in #9193
- Bump fast-uri from 3.1.7 to 3.1.9 by @dependabot[bot] in #9192
- Bump zookeeper.version from 3.9.5 to 3.9.7 by @dependabot[bot] in #9199
- Bump org.apache.maven.plugins:maven-surefire-report-plugin from 3.5.6 to 3.6.1 by @dependabot[bot] in #9195
- Bump commons-codec:commons-codec from 1.22.1 to 1.23.0 by @dependabot[bot] in #9196
- Bump activemq.version from 6.3.1 to 6.4.0 by @dependabot[bot] in #9198
- Bump org.rocksdb:rocksdbjni from 10.10.1.1 to 11.8.1 by @dependabot[bot] in #9200
- Bump org.xerial.snappy:snappy-java from 1.1.10.8 to 1.1.10.12 by @dependabot[bot] in #9202
- Bump com.github.ben-manes.caffeine:caffeine from 3.2.4 to 3.3.1 by @dependabot[bot] in #9204
- Bump com.github.luben:zstd-jni from 1.5.7-15 to 1.5.7-25 by @dependabot[bot] in #9213
- Bump surefire.version from 3.6.0 to 3.6.1 by @dependabot[bot] in #9218
- Bump spring.version from 7.0.9 to 7.0.10 by @dependabot[bot] in #9219
- Bump byte-buddy.version from 1.18.12 to 1.18.16 by @dependabot[bot] in #9222
- Bump com.esotericsoftware:kryo from 5.6.2 to 5.7.1 by @dependabot[bot] in #9223
- Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.4 by @dependabot[bot] in #9225
- Bump com.google.guava:guava from 33.7.1-jre to 33.7.2-jre by @dependabot[bot] in #9226
- Bump jetty.version from 12.1.12 to 12.1.14 by @dependabot[bot] in #9228
- Bump com.fasterxml.woodstox:woodstox-core from 7.2.2 to 7.3.0 by @dependabot[bot] in #9230
- Bump groovy.version from 4.0.33 to 6.0.0 by @dependabot[bot] in #9232
- Bump io.netty:netty-bom from 4.2.17.Final to 4.2.19.Final by @dependabot[bot] in #9235
- Bump vis-network from 10.1.2 to 10.1.4 by @dependabot[bot] in #9234
- Bump js-yaml from 5.4.2 to 5.5.0 by @dependabot[bot] in #9236
- Bump datatables.net-dt from 3.1.2 to 3.1.4 by @dependabot[bot] in #9237
- Bump cypress from 16.1.1 to 16.2.1 by @dependabot[bot] in #9238
- Bump cytoscape from 3.34.3 to 3.34.4 by @dependabot[bot] in #9239
- Bump webpack from 5.111.1 to 5.112.2 by @dependabot[bot] in #9241
- Bump start-server-and-test from 3.0.12 to 3.0.13 by @dependabot[bot] in #9244
- Bump prometheus.client.version from 1.8.0 to 1.10.0 by @dependabot[bot] in #9197
- Bump org.apache.hbase:hbase-client from 2.6.6-hadoop3 to 2.6.7-hadoop3 by @dependabot[bot] in #9212
- Bump datatables.net-bs5 from 3.1.2 to 3.1.4 by @dependabot[bot] in #9240
- Bump vis-data from 8.0.5 to 8.0.6 by @dependabot[bot] in #9242
- Bump express from 5.2.1 to 5.3.0 by @dependabot[bot] in #9245
- Bump qs from 6.15.2 to 6.17.1 by @dependabot[bot] in #9247
- Bump systeminformation from 5.31.17 to 5.33.19 by @dependabot[bot] in #9248
- Bump storm.kafka.client.version from 4.3.1 to 4.4.0 by @dependabot[bot] in #9208
- Bump org.apache.maven:maven-resolver-provider from 3.9.16 to 3.10.0 by @dependabot[bot] in #9211
- Bump io.opentelemetry:opentelemetry-bom from 1.66.0 to 1.67.0 by @dependabot[bot] in #9221
- Bump redis.clients:jedis from 8.0.1 to 8.0.2 by @dependabot[bot] in #9209
- Bump datatables.net from 3.1.2 to 3.1.4 by @dependabot[bot] in #9243
- Bump com.google.code.gson:gson from 2.14.0 to 2.15.0 by @dependabot[bot] in #9253
- Bump com.fasterxml.jackson.core:jackson-databind from 2.22.2 to 2.22.4 by @dependabot[bot] in #9254
- Bump org.ow2.asm:asm from 9.10.1 to 9.11.1 by @dependabot[bot] in #9255
- Bump org.apache.thrift:libthrift from 0.24.0 to 0.25.0 by @dependabot[bot] in #9256
- Bump org.jacoco:jacoco-maven-plugin from 0.8.15 to 0.8.16 by @dependabot[bot] in #9257
- Bump com.google.errorprone:error_prone_annotations from 2.50.0 to 2.52.0 by @dependabot[bot] in #9258
📖 Documentation
New Contributors
- @Zir0-93 made their first contribution in #9156
- @sharanggupta made their first contribution in #9186
- @ErnestasVaiciukeviciusAdform made their first contribution in #9175
- @jkrauss82 made their first contribution in #9153
Full Changelog: v3.1.0...v3.2.0