HIGH

CVE-2026-68981

Apache Nifi 2026-08-03 CVSS v3.1

CVSS

7.5

Description

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.

Weakness (CWE)

CWE-409

EPSS Score

0.52%

Probability of exploitation in next 30 days

43th percentile

References

https://lists.apache.org/thread/vxrqn7poyf1wx6gdy7c0dxqfqkctjngg Mailing List, Vendor Advisory http://www.openwall.com/lists/oss-security/2026/08/03/13 Mailing List, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE