LoginSign Up
← Back to all sparks
A

Apache Storm

ANALYTICS
Velocity0.0

Distributed real-time computation system

storm.apache.org ↗

Storm 3.1 adds an Iceberg sink and closes a long list of security gaps in Nimbus and the UI.

stream-processingsecurityapache-icebergjvmmodernization
◆Current state
Storm runs a 3.x line, started in July with 3.0.0's removal of all Clojure and a Java 21 baseline, alongside 2.8.x maintenance. 3.1.0 on September 12 adds a storm-iceberg module with an Apache Iceberg sink bolt and a setting to control JSONP wrapping, and spends most of its notes on hardening: log listings filtered by user permission, jar locations restricted to the Nimbus inbox, blobstore names confined to topology directories, TLS peer verification for worker connections and required Kryo class registration.
◆Where it's heading
After the 2.8.6 and 2.8.7 CVE releases, the 3.x line is closing access-control gaps across Nimbus, the logviewer and worker transport. The Iceberg sink adds a direct path into lakehouse storage.
◆Prediction
Expect 3.1.x follow-ups, possibly with security advisories for the hardened paths, and continued 2.8.x maintenance; whether more lakehouse connectors follow is unclear.

◆Recent moves

  1. 1mo ago

    Storm 3.1.0 adds an Iceberg sink and security hardening

    The first minor after 3.0.0: an Apache Iceberg sink bolt plus a long run of hardening fixes, from permission-filtered log listings to TLS peer verification between workers. It follows through on the security work that started with the 2.8.6 and 2.8.7 CVE releases.

    View source ↗
  2. 3mo ago

    Storm 3.0 drops Clojure entirely and moves to Java 21

    ⚡ SPARK

    The release the 2.x maintenance work was holding the door open for: no Clojure left in the codebase, Java 21 as the baseline, and the first substantial throughput changes in years — compressed tuples and cluster state, and a control plane split off from the data plane on receive queues. It marks the point where Storm's roadmap stops being about carrying legacy and starts being about scheduling and queueing.

    View source ↗
  3. 3mo ago

    2.8.9 is a dependency sweep with one Flux viewer guard

    Almost entirely Dependabot upgrades across the JVM and webapp dependency trees, plus a guard against js-yaml 5.x throwing on empty input in the Flux viewer. Published the same day as 3.0.0, which is the maintenance branch being brought current before attention moves to 3.x.

    View source ↗
  4. 3mo ago

    2.8.8 backports a Kafka topology-lag fix

    One backported fix for Kafka topology lag breaking when no offsets are committed, a docs link migration, and a long dependency list. One of three 2.8.x releases cut within two minutes of each other on 22 July.

    View source ↗
  5. 6mo ago

    Two TLS CVEs fixed: JVM-wide downgrade and auth bypass

    Fixes a Prometheus reporter setting that replaced the default SSL context and downgraded TLS for the entire JVM, and a case where failed TLS client authentication fell back to an ANONYMOUS principal instead of being rejected. The second is the more serious pattern — an authorization check that silently passed when authentication failed.

    View source ↗
  6. 6mo ago

    Deserialization RCE and stored XSS in the UI are fixed

    Storm was deserializing the base64 TGT credential blob through ObjectInputStream with no class filtering, giving any user with topology submission rights remote code execution in Nimbus and worker JVMs; a second issue allowed stored XSS through unsanitized topology metadata in the UI. Together with 2.8.7 this makes the pre-2.8.6 line unsafe to run in any multi-tenant deployment.

    View source ↗