CVE-2026-49361

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service. This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0. Users are recommended to upgrade to version 0.9.1, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/dccw6tj0njwtmvbftq13mw7fdhsok373	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/30/5	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:fluss:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-01 09:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-49361

Mitre link : CVE-2026-49361

CVE.ORG link : CVE-2026-49361

JSON object : View

Products Affected

apache

fluss

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-49361", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49361", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T16:48:48.271773Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Fluss (incubating)", "versions": [{"status": "affected", "version": "0.8.0", "versionType": "semver"}, {"status": "affected", "version": "0.9.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-01T09:16:20.880", "references": [{"url": "https://lists.apache.org/thread/dccw6tj0njwtmvbftq13mw7fdhsok373", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/30/5", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service.\n\nThis issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0.\n\nUsers are recommended to upgrade to version 0.9.1, which fixes the issue."}, {"lang": "es", "value": "Las versiones de Apache Fluss anteriores a la 0.9.1 configuran el Netty LengthFieldBasedFrameDecoder con Integer.MAX_VALUE como la longitud m\u00e1xima de trama, permitiendo a atacantes remotos no autenticados agotar la memoria heap de la JVM en TabletServer y CoordinatorServer enviando encabezados de trama especialmente dise\u00f1ados, lo que resulta en una denegaci\u00f3n de servicio.\n\nEste problema afecta a Apache Fluss (en incubaci\u00f3n): 0.8.0 y 0.9.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 0.9.1, que corrige el problema."}], "lastModified": "2026-07-22T07:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:fluss:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "934071BF-644A-4E67-96EB-82996C2A0BD8", "versionEndExcluding": "0.9.1", "versionStartIncluding": "0.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}