CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache NiFito a version that resolves this vulnerability.Fixed in 2.12.0Patch CVE-2026-70469
Event History
Frequently Asked Questions
Who is exposed to this issue?
Apache NiFi deployments running version 2.11.0 with the application REST API reachable by malicious clients are exposed to crafted HTTP requests that can cause excessive memory consumption.
What does an attacker need to do to exploit it?
An attacker needs to send crafted HTTP requests using multiple Content-Encoding headers or non-standard identifiers for gzip encoding. These inputs can bypass the framework filter's intended rejection of gzip-encoded requests.
Is upgrading the only mitigation described?
The provided mitigation is upgrading to Apache NiFi 2.12.0. That version disables decompression of gzip-encoded HTTP requests regardless of how many Content-Encoding headers are supplied or which gzip encoding identifiers are used.