Apache NiFi 1.5.0 through 2.10.0 supports gzip-encoded HTTP requests for its REST API using a Jersey encoding filter. The vulnerability arises because the framework enforces a configurable maximum request size on the compressed payload instead of the decompressed output. This improper handling of highly compressed data (CWE-409) can lead to data amplification, allowing a malicious client to cause excessive memory consumption on the server. The recommended mitigation is upgrading to Apache NiFi 2.11.0, which relocates response compression to the Jetty Server and disables decompression of gzip-encoded HTTP requests, thus preventing this attack vector.

An attacker can exploit this vulnerability by sending specially crafted gzip-encoded HTTP requests that appear within allowed compressed size limits but decompress to a much larger size, causing excessive memory consumption on the server. This can lead to denial of service or resource exhaustion. The CVSS 4.0 score is 8.8 (high severity), indicating a significant impact on availability and resource usage without requiring authentication or user interaction.

Upgrade Apache NiFi to version 2.11.0 or later. This version relocates response compression to the Jetty Server and disables decompression of gzip-encoded HTTP requests, effectively mitigating the vulnerability. No other mitigations are indicated or recommended by the vendor.