CVE-2026-68981 Details
Description
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
A vulnerability allowing uncontrolled resource consumption has been identified in Apache NiFi versions 1.5.0 through 2.10.0. This issue arises from the application's support for gzip-encoded HTTP requests in the REST API, managed by a Jersey encoding filter. The framework imposed a configurable maximum request size on the compressed data instead of the decompressed content. This flaw enables a malicious client to send specially crafted requests that can excessively drain memory resources. The recommended mitigation is to upgrade to Apache NiFi 2.11.0, which shifts response compression to Jetty Server and disables the decompression of gzip-encoded HTTP requests.
Users are advised to upgrade to Apache NiFi version 2.11.0, which addresses this vulnerability by relocating response compression to Jetty Server and disabling the decompression of gzip-encoded HTTP requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/08/03/13 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/vxrqn7poyf1wx6gdy7c0dxqfqkctjngg | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache nifi | >= 1.5.0, < 2.11.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | CVE Modified | CVE |
| Aug 3, 2026 | New CVE Received | [email protected] |