Apache Fluss versions before 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with a maximum frame length of Integer.MAX_VALUE, which allows an unauthenticated remote attacker to send specially crafted frame headers that exhaust JVM heap memory. The resulting denial of service renders the TabletServer and CoordinatorServer unable to process requests until the heap is reclaimed.

The affected product is Apache Fluss (incubating) versions 0.8.0 and 0.9.0, identified by the Apache Software Foundation.

The CVSS score is 7.5 and the EPSS score is < 1%. Although the EPSS indicates a very low probability of exploitation, the CVSS score reflects a high severity, underscoring the potential for significant impact. The vulnerability enables an attacker with network access to the Fluss servers to submit malformed frames that consume all JVM heap memory, leading to service disruption. The issue is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated, inferred from the description that the attacker can send crafted frame headers to the server.