CVE-2021-40865

Unsafe Pre-Authentication Deserialization In Workers

9.8 CriticalPublic exploitFix available

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

64.2%Up 62.8 points since Oct 26, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-40865
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

Unsafe Pre-Authentication Deserialization In Workers

Record: CVE-2021-40865
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2021-2262 No score

Record: EUVD-2021-2262
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w729-7633-2fw5 9.8

Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm

Record: GHSA-w729-7633-2fw5
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

Record: CVE-2021-40865
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-w729-7633-2fw5 9.8

Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm

Record: GHSA-w729-7633-2fw5
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVOESA-2021-1415 9.8

storm security update

Apache Storm realtime computation system

Security Fix(es):

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4.(CVE-2021-40865) A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.(CVE-2021-38294)

Record: OESA-2021-1415
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.storm:storm` Maven	2.2.0 up to 2.2.1	2.2.1
`org.apache.storm:storm` Maven	1.0.0 up to 1.2.4	1.2.4
`org.apache.storm:storm` Maven	2.1.0 up to 2.1.1	2.1.1
`org.apache.storm:storm` Maven	1.0.0 up to 1.2.4, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 Show 9 moreShow less 1.0.61.1.01.1.11.1.21.1.31.2.01.2.11.2.21.2.3	1.2.4
`storm` openEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs	before 1.2.4-1.oe1	1.2.4-1.oe1
`storm` openEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs	before 1.2.4-1.oe1	1.2.4-1.oe1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	hktalent/CVE-2021-40865	2021-11-26

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-40865 is a critical vulnerability (CVSS 9.8) in Apache Storm, published October 25, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 64.2%, the 99th percentile. Fixed in org.apache.storm:storm 2.2.1.