PUBLISHED
2026-09-16 20:17
MODIFIED
2026-09-16 20:36
EPSS (Prob. Exploit)
0.62%
Top 51.3%
> DESCRIPTION
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) - The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
AFFECTED PACKAGES:
Unknown / Unknown
3 versions affected
ALIASES:
BIT-nifi-2026-70469
> HISTORIQUE DES MODIFICATIONS
Première apparition
16/09/2026 20:17
Source: NVD
📊
ENRICHISSEMENT
01/10/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) - The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a lar...
Total des modifications: 1
Dernière mise à jour: 3 weeks ago