24 matches found
Denial Of Service (DoS)
Apache Fluss is vulnerable to Denial Of Service DoS. The vulnerability is due to configuring Netty's LengthFieldBasedFrameDecoder with an excessively large maximum frame length, which allows an unauthenticated remote attacker to send crafted frame headers and exhaust JVM heap memory on the...
CVE-2026-49361
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper configuration of the LengthFieldBasedFrameDecoder value. An attacker can cause the application to exhaust JVM heap memory and disrupt service availability by sending...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper configuration of the LengthFieldBasedFrameDecoder value. An attacker can cause the application to exhaust JVM heap memory and disrupt service availability by sending...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper configuration of the LengthFieldBasedFrameDecoder value. An attacker can cause the application to exhaust JVM heap memory and disrupt service availability by sending...
org.apache.fluss:fluss-kafka (>=0.8.0-incubating, <=0.9.0-incubating) potentially affected by CVE-2026-49361 via org.apache.fluss:fluss-rpc (>=0.8.0-incubating, <=0.9.0-incubating)
org.apache.fluss:fluss-rpc MAVEN version =0.8.0-incubating, =0.8.0-incubating, =0.9.0-incubating Source cves: CVE-2026-49361 Source advisory: SNYK:JAVA-ORGAPACHEFLUSS-17139463...
GHSA-4C39-FWGJ-4VQ7 Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
org.apache.fluss:fluss-dist (0.8.0-incubating), org.apache.fluss:fluss-docgen (0.9.0-incubating) +21 more potentially affected by CVE-2026-49361 via org.apache.fluss:fluss-common (>=0.8.0-incubating, <=0.9.0-incubating)
org.apache.fluss:fluss-common MAVEN version =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating,...
CVE-2026-49361
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
CVE-2026-49361
Apache Fluss versions 0.8.0 and 0.9.0 are vulnerable to a denial of service (DoS) attack due to an uncontrolled resource consumption issue (CWE-400 ). The root cause is that the Netty LengthFieldBasedFrameDecoder is configured with Integer.MAX_VALUE as the maximum frame length. This allows unauth...
CVE-2026-49361 Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
EUVD-2026-33600
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
CVE-2026-49361
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
CVE-2026-49361 Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
CVE-2026-49361 Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
CVE-2026-49361
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
org.apache.fluss:fluss-docgen (0.9.0-incubating), org.apache.fluss:fluss-fs-azure (0.9.0-incubating) +20 more potentially affected by CVE-2026-49361 via org.apache.fluss:fluss-common (0.9.0-incubating)
org.apache.fluss:fluss-common MAVEN version 0.9.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.fluss:fluss-common and may be impacted: - org.apache.fluss:fluss-docgen 0.9.0-incubating - org.apache.fluss:fluss-fs-azure...
PT-2026-45385
Name of the Vulnerable Software and Affected Versions Apache Fluss versions prior to 0.9.1 Description The Netty LengthFieldBasedFrameDecoder is configured with Integer.MAX VALUE as the maximum frame length. This allows unauthenticated remote attackers to exhaust JVM heap memory on TabletServer a...
CVE-2026-49361: Allocation of Resources Without Limits or Throttling
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAXVALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting...
Stadt Land Fluss Duell - BSD license, Customized SSL, Dangerous filesystem permissions vulnerabilities
HackApp vulnerability scanner discovered that application Stadt Land Fluss Duell published at the 'play' market has multiple vulnerabilities...