Apache NiFi's gzip request handling bypasses size limits, opening a memory-exhaustion path, fixed in 2.11.0
Status: UPDATED
| Advisory ID: CVE-2026-68981
Key Details
| CVE | CVE-2026-68981 |
| CVSS Score / Version | 7.5 (High) / CVSS v3.1 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high. |
| Affected products | Apache nifi |
| Classified as | CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification)) |
| Exploitation prediction (EPSS) | 0.52% probability of exploitation in the next 30 days (43% percentile) -- FIRST.org's EPSS model. |
Affected Products, Subsystems & Sectors
| Subsystems | General OT |
| Sectors | Multiple |
What to Know
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
What to Do
Monitor Apache's web page for any future patch releases. See vendor advisory link below.
References