CVE-2026-68981
Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
| CWE | CWE-409 |
| Vendor | apache software foundation |
| Product | apache nifi |
| Published | Aug 3, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache nifi
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache nifi are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache NiFi
1.5.0 ≤ 2.10.0
References
Credits
mak3bread (Minseong Kim)