PT-2026-45385 · Apache · Apache Fluss

Andrea Cosentino · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-49361

Mitre

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service.

This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0.

Users are recommended to upgrade to version 0.9.1, which fixes the issue.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-49361

Affected Products

Apache Fluss

References · 3

• https://lists.apache.org/thread/dccw6tj0njwtmvbftq13mw7fdhsok373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49361 · Security Note
• http://openwall.com/lists/oss-security/2026/05/30/5 · Note