CVE-2026-49361: Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability

Synopsis

This is a memory exhaustion (denial-of-service) vulnerability in Apache Fluss versions 0.8.0 and 0.9.0. The affected Netty LengthFieldBasedFrameDecoder is configured with no practical frame-size limit, so an unauthenticated attacker reachable over the network can send crafted frame headers that force the JVM to allocate heap memory until it is exhausted. Successful exploitation crashes the TabletServer or CoordinatorServer process, taking the affected Fluss node out of service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment Apache publishes version 0.9.1 or an equivalent upstream fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the TabletServer or CoordinatorServer Netty listener over the network; any host with a TCP route to the service port is within scope.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the vulnerable frame decoder processes incoming data before any authentication step.

• Victim interactionNot required

  The attack is fully remote and passive from the victim side; no user action or approval is required.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: the attacker only needs to send a crafted frame header with a large declared length, with no race condition or environmental prerequisite.

Blast Radius

• Exhausts JVM heap memory on the targeted TabletServer or CoordinatorServer process, causing an out-of-memory crash.
• Takes the affected Fluss node out of service, disrupting data ingestion or cluster coordination depending on which server type is targeted.
• A sustained or repeated attack can keep nodes unavailable, degrading or halting the entire Fluss cluster until the process is restarted.