PUBLISHED
2026-06-01 09:16
MODIFIED
2026-06-01 09:16
EPSS (Prob. Exploit)
0.83%
Top 42.4%
> DESCRIPTION
Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service.
This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0.
Users are recommended to upgrade to version 0.9.1, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-400: Uncontrolled Resource Consumption - The product does not properly control the allocation and maintenance of a limited resource. | CWE-770: Allocation of Resources Without Limits or Throttling - The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
> GITHUB SECURITY ADVISORY
GHSA-4c39-fwgj-4vq7
HIGH
Apache Fluss: Unauthenticated remote attackers can exhaust JVM heap memory using crafted frame headers via TabletServer/CoordinatorServer
AFFECTED PACKAGES:
MAVEN / org.apache.fluss:fluss-common
>= 0.8.0-incubating-rc1, < 0.9.1-incubating
Fixed in: 0.9.1-incubating
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability
ALIASES:
GHSA-4c39-fwgj-4vq7
> HISTORIQUE DES MODIFICATIONS
Première apparition
01/06/2026 09:16
Source: NVD
📊
ENRICHISSEMENT
01/07/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-400: Uncontrolled Resource Consumption - The product does not properly control the allocation and maintenance of a limited resource. | CWE-770: Allocation of Resources Without Limits or Throttling...
Total des modifications: 1
Dernière mise à jour: 4 months ago