CVE-2026-68981

Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Assigner: apache
Reserved: 01.08.2026 Published: 03.08.2026 Updated: 03.08.2026

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Amber
CVSS Score: 8.8

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Apache Software Foundation
Product	Apache NiFi
Versions	Default: unaffected affected from 1.5.0 to 2.10.0 (incl.)

Vendor

Apache Software Foundation

Product

Apache NiFi

Versions

Default: unaffected

affected from 1.5.0 to 2.10.0 (incl.)

Credits

mak3bread (Minseong Kim) finder

References

Problem Types