Product · Apache Software Foundation

Apache Fluss (incubating)

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.5

CVE-2026-49361

Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending spe…

Apache Software Foundation Apache Fluss (incubating) org.apache.fluss:fluss-common Maven

Jun 1, 2026