CVE-2026-49361General(apache / fluss)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, allowing unauthenticated remote attackers to exhaust JVM heap memory on TabletServer and CoordinatorServer by sending specially crafted frame headers, resulting in denial of service. This issue affects Apache Fluss (incubating): 0.8.0 and 0.9.0. Users are recommended to upgrade to version 0.9.1, which fixes the issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-400CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fluss

Threat summary

4 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
General: 4 classified signals
Peaked 3d ago at 1 mentions (2026-05-30); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

apache

Products

fluss

Deep dive

Activity timeline4 mentions / 4d

Signal classification1 categories

General

4100.0%

Referenced assets3 URLs

By indicator

Full discourse4 posts

Open Source Security mailing list@oss_security135d
General
CVE-2026-49361: Apache Fluss Netty Frame Decoder Memory Exhaustion https://www.openwall.com/lists/oss-security/2026/05/30/5 Severity: important
Post summary
The entry announces CVE-2026-49361 as a memory exhaustion flaw in Apache Fluss Netty Frame Decoder, but provides no evidence of PoC, active exploitation, or remediation.
00020346
4.7K followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker114d
General
CVE-2026-49361 Apache Flussの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/14/cve-2026-49361-apache-fluss/ #IT #Security #cybersecurity
Post summary
The text simply announces a summary article for CVE-2026-49361 and provides a link, without offering technical details, PoC, exploit code, or mitigation guidance.
0000059
208 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker116d
General
CVE-2026-49361 Apache Flussの脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/06/14/cve-2026-49361-apache-fluss/ #IT #Security #cybersecurity
Post summary
The post references CVE‑2026‑49361 and indicates it covers an explanation of the Apache Fluss vulnerability along with a summary of impact and countermeasures, but provides no detailed technical or mitigation information.
0000041
208 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-49361 CVE-2026-49361 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49361
Post summary
The post merely repeats the CVE‑ID (CVE‑2026‑49361) and links to a vulnerability detail page, offering no further technical or exploit information.
0000063
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	fluss	-	-	-

Explore more

Back to dashboard apache CVEs fluss vulnerabilities

What researchers are saying

CVE-2026-49361

Open Source Security mailing list@oss_securityGeneral

The entry announces CVE-2026-49361 as a memory exhaustion flaw in Apache Fluss Netty Frame Decoder, but provides no evidence of PoC, active exploitation, or remediation.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The text simply announces a summary article for CVE-2026-49361 and provides a link, without offering technical details, PoC, exploit code, or mitigation guidance.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The post references CVE‑2026‑49361 and indicates it covers an explanation of the Apache Fluss vulnerability along with a summary of impact and countermeasures, but provides no detailed technical or mitigation information.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The post merely repeats the CVE‑ID (CVE‑2026‑49361) and links to a vulnerability detail page, offering no further technical or exploit information.