Denial Of Service (DoS)

Apache Fluss is vulnerable to Denial Of Service DoS. The vulnerability is due to configuring Netty's LengthFieldBasedFrameDecoder with an excessively large maximum frame length, which allows an unauthenticated remote attacker to send crafted frame headers and exhaust JVM heap memory on the...

CVE-2026-49361: Allocation of Resources Without Limits or Throttling

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...