LoginSign Up
← Back to all sparks
A

Apache Storm

ANALYTICS
Velocity2.5

Distributed real-time computation system

storm.apache.org ↗

Storm 3.2 fixes three access-control CVEs and ends the 2.x line.

stream-processingsecurityobservabilityjvmmodernization
◆Current state
Apache Storm 3.2.0 arrived on 11 November with fixes for three CVEs: the supervisor page revealing other users' topologies, the Logviewer following symlinks past ACLs, and DRPC impersonation bypassing the authorizer. It declares Storm 2.x end of life, removes several deprecated configs and serializers, and adds pluggable tuple tracing with OpenTelemetry, a Prometheus reporter for V2 metrics and opt-in virtual threads on Java 25.
◆Where it's heading
The 3.x line keeps pairing security hardening with removal of legacy code, following 3.0's Clojure removal and 3.1's long hardening list. With 2.x now unsupported and deprecated APIs classified for removal, Storm is narrowing to a modern-JVM codebase with standard observability hooks.
◆Prediction
Further removals flagged in 3.2, such as the Pacemaker subsystem, are likely in the next minor, alongside more security fixes from outside reporters.

◆Recent moves

  1. 3d ago

    Storm 3.2.0: three CVE fixes, OpenTelemetry tracing, 2.x EOL

    Fixes three access-control CVEs with behaviour changes to the Logviewer and DRPC, ends support for 2.x, removes deprecated configs and adds OpenTelemetry tuple tracing and a Prometheus reporter. It continues the 3.x pattern of hardening plus legacy cleanup.

    View source ↗
  2. 2mo ago

    Storm 3.1.0 adds an Iceberg sink and security hardening

    The first minor after 3.0.0: an Apache Iceberg sink bolt plus a long run of hardening fixes, from permission-filtered log listings to TLS peer verification between workers. It follows through on the security work that started with the 2.8.6 and 2.8.7 CVE releases.

    View source ↗
  3. 3mo ago

    Storm 3.0 drops Clojure entirely and moves to Java 21

    ⚡ SPARK

    The release the 2.x maintenance work was holding the door open for: no Clojure left in the codebase, Java 21 as the baseline, and the first substantial throughput changes in years — compressed tuples and cluster state, and a control plane split off from the data plane on receive queues. It marks the point where Storm's roadmap stops being about carrying legacy and starts being about scheduling and queueing.

    View source ↗
  4. 3mo ago

    2.8.9 is a dependency sweep with one Flux viewer guard

    Almost entirely Dependabot upgrades across the JVM and webapp dependency trees, plus a guard against js-yaml 5.x throwing on empty input in the Flux viewer. Published the same day as 3.0.0, which is the maintenance branch being brought current before attention moves to 3.x.

    View source ↗
  5. 3mo ago

    2.8.8 backports a Kafka topology-lag fix

    One backported fix for Kafka topology lag breaking when no offsets are committed, a docs link migration, and a long dependency list. One of three 2.8.x releases cut within two minutes of each other on 22 July.

    View source ↗
  6. 6mo ago

    Two TLS CVEs fixed: JVM-wide downgrade and auth bypass

    Fixes a Prometheus reporter setting that replaced the default SSL context and downgraded TLS for the entire JVM, and a case where failed TLS client authentication fell back to an ANONYMOUS principal instead of being rejected. The second is the more serious pattern — an authorization check that silently passed when authentication failed.

    View source ↗