Denial of Service Vulnerability in Apache Fluss by The Apache Software Foundation

CVE-2026-49361

What is CVE-2026-49361?

The Apache Fluss application, specifically versions prior to 0.9.1, is susceptible to a Denial of Service attack. This vulnerability arises from the improper configuration of the Netty LengthFieldBasedFrameDecoder, which sets the maximum frame length to Integer.MAX_VALUE. Malicious actors may exploit this flaw by sending specifically crafted frame headers, which can lead to exhaustion of the JVM heap memory on both the TabletServer and CoordinatorServer. As a result, normal operations can be severely disrupted, causing unavailability of services. It is strongly recommended that users upgrade to version 0.9.1 to mitigate this vulnerability.

References