What’s Vulnerable › Vulnerabilities

CVE-2026-49361: Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-01 · updated 2026-07-22
• Weakness: CWE-400

Description

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service. This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0. Users are recommended to upgrade to version 0.9.1, which fixes the issue.

Affected products

• Apache Software Foundation Apache Fluss (incubating): from 0.8.0 before 0.9.1 — fixed in 0.9.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Fluss (incubating) 0.9.1. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/dccw6tj0njwtmvbftq13mw7fdhsok373
• http://www.openwall.com/lists/oss-security/2026/05/30/5

Get alerted when CVE-2026-49361 or the next vulnerability affects your stack