CVE-2026-49361

Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability

Published Jun 1, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service.

This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0.

Users are recommended to upgrade to version 0.9.1, which fixes the issue.

Analysis

Technical impact

Apache Fluss versions before 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with a maximum frame length of Integer.MAX_VALUE, which allows an unauthenticated remote attacker to send specially crafted frame headers that exhaust JVM heap memory. The resulting denial of service renders the TabletServer and CoordinatorServer unable to process requests until the heap is reclaimed.

Affected Systems

The affected product is Apache Fluss (incubating) versions 0.8.0 and 0.9.0, identified by the Apache Software Foundation.

Risk and Exploitability

The CVSS score is 7.5 and the EPSS score is < 1%. Although the EPSS indicates a very low probability of exploitation, the CVSS score reflects a high severity, underscoring the potential for significant impact. The vulnerability enables an attacker with network access to the Fluss servers to submit malformed frames that consume all JVM heap memory, leading to service disruption. The issue is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated, inferred from the description that the attacker can send crafted frame headers to the server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Fluss (incubating)

unaffected

Version	Status	Constraints
`0.8.0`	affected	—
`0.9.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:apache:fluss:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Apache

Fluss (incubating)

Version	Status	Scheme	Platform
`0.8.0`	affected	semver	—
`0.9.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache Fluss to version 0.9.1
If an upgrade is not immediately possible, block or severely restrict inbound network traffic that could reach the Fluss servers from untrusted sources
Monitor JVM heap usage for sudden spikes that may indicate a memory exhaustion attack

Generated by OpenCVE AI on June 1, 2026 at 18:43 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-4c39-fwgj-4vq7	Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.831% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/05/30/5
https://lists.apache.org/thread/dccw6tj0njwtmvbftq13mw7fdhsok373

History

Jun 3, 2026 2:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache fluss (incubating)
Vendors & Products		Apache fluss (incubating)

Jun 1, 2026 6:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache fluss
CPEs		cpe:2.3:a:apache:fluss::::::::
Vendors & Products		Apache Apache fluss

Jun 1, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 1, 2026 11:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/05/30/5

Jun 1, 2026 9:15 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service. This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0. Users are recommended to upgrade to version 0.9.1, which fixes the issue.
Title		Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
Weaknesses		CWE-400 CWE-770
References		https://lists.apache.org/thread/dccw6tj0njwtmvbftq13mw7fdhsok373