CVE-2026-49361

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49361
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49361.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49361
Aliases
Published
2026-06-01T07:57:27.038Z
Modified
2026-07-08T20:11:36.427330697Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
Details

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service.

This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0.

Users are recommended to upgrade to version 0.9.1, which fixes the issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.8.0"
                },
                {
                    "last_affected": "0.8.0"
                },
                {
                    "introduced": "0.9.0"
                },
                {
                    "last_affected": "0.9.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49361.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/apache/fluss

Affected ranges

Type
GIT
Repo
https://github.com/apache/fluss
Events
Introduced
c18e53ed053161699163b0a5aa67141a61ae53b6
Fixed
6bf969f71af8d6f9cc37383ab89ae46a58b0e227
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:fluss:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.8.0"
        },
        {
            "fixed": "0.9.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49361.json"