Executive brief
Apache Fluss, a streaming storage system, is vulnerable to a denial-of-service attack. An unauthenticated remote attacker can send specially crafted network requests that cause the system to consume all available memory. This results in the TabletServer or CoordinatorServer crashing or becoming unresponsive, disrupting data operations and system availability.
Technical details
Apache Fluss (incubating) versions prior to 0.9.1 utilize the Netty LengthFieldBasedFrameDecoder with an improperly configured maximum frame length set to Integer.MAX_VALUE. This allows an unauthenticated remote attacker to send a crafted frame header specifying an extremely large length, causing the TabletServer or CoordinatorServer to attempt to allocate a massive buffer in the JVM heap. This leads to an OutOfMemoryError (OOM) and subsequent denial of service. The vulnerability is tracked as CVE-2026-49361 and is resolved in version 0.9.1 by introducing a configurable bound on request sizes (netty.server.max-request-size).
Affected products
- Apache Fluss (incubating) 0.8.0, 0.9.0
Timeline
- 2026-05-04: patched: Version 0.9.1-incubating released
- 2026-05-30: disclosed: Public disclosure on oss-security mailing list
- 2026-06-01: advisory: GitHub and NVD advisories published