CVE-2026-70469: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) in Apache Software Foundation Apache NiFi
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
AI Analysis
Technical Summary
Apache NiFi 2.11.0 disabled gzip-encoded HTTP request support for its REST API by rejecting requests with the standard Content-Encoding header indicating gzip. However, the enforcement filter failed to check for multiple Content-Encoding headers and did not reject non-standard gzip encoding identifiers. This allowed a malicious client to send specially crafted requests that could cause excessive memory consumption due to improper handling of highly compressed data, classified under CWE-409 (Improper Handling of Highly Compressed Data). The recommended mitigation is upgrading to Apache NiFi 2.12.0, which disables decompression of gzip-encoded HTTP requests regardless of the number of headers or encoding identifiers.
Potential Impact
The vulnerability can lead to excessive memory consumption on the affected Apache NiFi 2.11.0 server when processing crafted HTTP requests with multiple or non-standard gzip Content-Encoding headers. This could degrade service availability or cause denial of service conditions due to resource exhaustion. There is no indication of remote code execution or data disclosure from the provided information.
Mitigation Recommendations
Upgrade Apache NiFi to version 2.12.0, which disables decompression of gzip-encoded HTTP requests regardless of the number of Content-Encoding headers or encoding identifiers. This official fix fully mitigates the vulnerability.
CVE-2026-70469: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) in Apache Software Foundation Apache NiFi
Description
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
Affected software
Apache Software Foundation
Apache NiFi
pkg:maven/Apache Software Foundation/org.apache.nifi:nifi-jettyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache NiFi 2.11.0 disabled gzip-encoded HTTP request support for its REST API by rejecting requests with the standard Content-Encoding header indicating gzip. However, the enforcement filter failed to check for multiple Content-Encoding headers and did not reject non-standard gzip encoding identifiers. This allowed a malicious client to send specially crafted requests that could cause excessive memory consumption due to improper handling of highly compressed data, classified under CWE-409 (Improper Handling of Highly Compressed Data). The recommended mitigation is upgrading to Apache NiFi 2.12.0, which disables decompression of gzip-encoded HTTP requests regardless of the number of headers or encoding identifiers.
Potential Impact
The vulnerability can lead to excessive memory consumption on the affected Apache NiFi 2.11.0 server when processing crafted HTTP requests with multiple or non-standard gzip Content-Encoding headers. This could degrade service availability or cause denial of service conditions due to resource exhaustion. There is no indication of remote code execution or data disclosure from the provided information.
Mitigation Recommendations
Upgrade Apache NiFi to version 2.12.0, which disables decompression of gzip-encoded HTTP requests regardless of the number of Content-Encoding headers or encoding identifiers. This official fix fully mitigates the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-04T15:09:34.902Z
- State
- PUBLISHED
Threat ID: 6aaaf2ab55bf5e2cf5146039
Added to database: 09/16/2026, 19:48:59 UTC
Last enriched: 09/16/2026, 20:02:05 UTC
Last updated: 09/17/2026, 02:03:06 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.