{"action":"Upgrade org.apache.storm:storm-client to 2.8.6 or later.","affected":[{"fixed":"2.8.6","introduced":"0"}],"component":"org.apache.storm:storm-client","cve_ids":["CVE-2026-35337"],"ecosystem":"Maven","epss":0.01011,"exploited":false,"fixed_versions":["2.8.6"],"ghsa_id":"GHSA-jf89-3q6q-vcgr","id":"tcs_01M5N92NSQHYEWWNW6QSW4DXMC","modified_at":"2026-04-14T23:11:26.035032Z","published_at":"2026-04-13T12:31:15Z","references":["https://osv.dev/vulnerability/GHSA-jf89-3q6q-vcgr","https://nvd.nist.gov/vuln/detail/CVE-2026-35337","https://github.com/apache/storm","https://storm.apache.org/2026/04/12/storm286-released.html","http://www.openwall.com/lists/oss-security/2026/04/12/6"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-jf89-3q6q-vcgr","url":"https://osv.dev/vulnerability/GHSA-jf89-3q6q-vcgr"}],"summary":"Apache Storm: Deserialization of Untrusted Data vulnerability"}