CVE-2026-49361

Apache Fluss versions 0.8.0 and 0.9.0 are vulnerable to a denial of service (DoS) attack due to an uncontrolled resource consumption issue (CWE-400 ). The root cause is that the Netty LengthFieldBasedFrameDecoder is configured with Integer.MAX_VALUE as the maximum frame length. This allows unauth...