Apache NiFi REST API Vulnerability in Version 2.11.0

CVE-2026-70469

What is CVE-2026-70469?

The vulnerability in Apache NiFi 2.11.0 arises from the improper validation of gzip-encoded HTTP requests made to the application's REST API. The existing framework filter fails to adequately address multiple instances of the Content-Encoding header, allowing attackers to bypass restrictions on gzip encoding. This oversight can lead to excessive memory usage, potentially resulting in performance degradation or service disruption. Users are strongly advised to upgrade to version 2.12.0, which implements stricter controls on gzip processing, ensuring that all decompression of gzip-encoded requests is appropriately managed regardless of the headers used.

References