Description
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
Published: 2026-09-16
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Immediate Patch
AI Analysis

Impact

Apache NiFi 2.11.0 incorrectly handled the Content‑Encoding header for gzip‑encoded HTTP requests. The filter allowed multiple instances of the header and did not reject non‑standard identifiers for gzip, enabling an attacker to send specially crafted requests that cause the application to decompress unbounded data and consume excessive memory, potentially leading to a denial of service.

Affected Systems

The vulnerability affects Apache NiFi from the Apache Software Foundation, specifically version 2.11.0. Upgrading to 2.12.0 removes the issue by disabling gzip decompression handling for HTTP requests.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is below 1%, indicating low exploitation probability at the time of this analysis, and it is not listed in the CISA KEV catalog. The attack vector is remote over HTTP; an attacker can craft a request with multiple or malformed Content‑Encoding headers to trigger large memory consumption.

Generated by OpenCVE AI on September 18, 2026 at 00:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache NiFi to version 2.12.0 or newer, which disables decompression of gzip‑encoded HTTP requests regardless of header number or encoding identifiers.
  • If an upgrade cannot be performed immediately, configure a front‑end proxy or firewall to reject HTTP requests that contain duplicate Content‑Encoding headers or non‑standard gzip identifiers before they reach NiFi.
  • Monitor NiFi server memory usage for abnormal spikes and set alerts to detect potential memory exhaustion attacks, taking corrective action if thresholds are breached.

Generated by OpenCVE AI on September 18, 2026 at 00:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:nifi:2.11.0:*:*:*:*:*:*:*

Fri, 18 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache nifi
Vendors & Products Apache
Apache nifi

Thu, 17 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
References

Wed, 16 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
Title Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Weaknesses CWE-409
References

Subscriptions

Apache Nifi
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-09-17T19:38:26.785Z

Reserved: 2026-08-04T15:09:34.902Z

Link: CVE-2026-70469

cve-icon Vulnrichment

Updated: 2026-09-17T19:38:23.503Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-16T20:17:26.877

Modified: 2026-09-21T13:42:42.460

Link: CVE-2026-70469

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T03:45:01Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)