CVE-2026-68981CWE-409

CVE-2026-68981

High · published August 4, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00740 · 54.1th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-08-04T00:17Z
Affected products (1)
ProductVersionsFixed in
apache/nifi≥ 1.5.0, < 2.11.02.11.0
References (2)
https://lists.apache.org/thread/vxrqn7poyf1wx6gdy7c0dxqfqkctjngg · [email protected]http://www.openwall.com/lists/oss-security/2026/08/03/13 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 AUG 19:59Z
    Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
    cvelistv5