CVE-2026-68981
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Amber
- EPSS probability
- 0.52%
- CWE
- CWE-409
- Published
- 2026-08-03
- Last modified
- 2026-08-04
Affected products
- Apache Software Foundation Apache NiFi
Weakness type
Related vulnerabilities
- CVE-2026-79695 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-69304 — ASP.NET Core Denial of Service Vulnerability
- CVE-2026-85786 — Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
- CVE-2026-82520 — parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments
- CVE-2026-84382 — HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
- CVE-2026-78594 — Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service
- CVE-2026-72628 — Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
- CVE-2026-82864 — pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb