GitHub Advisoryadvisory · Maven

GHSA-4c39-fwgj-4vq7 Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer

HIGH Published 2026-06-01 Modified 2026-07-08 Official page ↗
Aliases
CVE-2026-49361
Ecosystem
Maven
Packages
org.apache.fluss:fluss-common
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-07-08

Affected packages

• Maven org.apache.fluss:fluss-common: >= 0.8.0-incubating-rc1, < 0.9.1-incubating → fixed in 0.9.1-incubating

Description

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service. This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0. Users are recommended to upgrade to version 0.9.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-49361 Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length,… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References