The vulnerability arises from Apache NiFi’s handling of gzip‑encoded HTTP requests. The application enforces a maximum size only on the compressed payload, not on the decompressed output. A malicious client can therefore send a small compressed payload that expands to a much larger uncompressed body, forcing NiFi to allocate excessive memory and potentially crash or become unresponsive. This flaw is a classic resource exhaustion weakness (CWE‑409) that can compromise availability but not confidentiality or integrity.

Apache NiFi versions 1.5.0 through 2.10.0 are affected. Upgrading to version 2.11.0 or later removes the vulnerability by moving response compression to Jetty Server and disabling decompression of gzip‑encoded HTTP requests.

The CVSS score of 8.8 indicates high severity and a significant risk of denial of service if exploited. EPSS is not available, so the likelihood of exploitation is unknown from the data; however, the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker does not need special privileges or authentication to target the REST API; remote clients can send crafted requests to consume the server’s memory, leading to degraded performance or crashes.