Threats tagged 'ghsa-56vg-25rp-h2c5'

Apache NiFi version 2.11.0 contains a vulnerability related to improper handling of gzip-encoded HTTP requests. The application REST API disabled support for gzip encoding but did not properly validate multiple Content-Encoding headers or non-standard gzip identifiers. This flaw allows crafted requests to consume excessive memory, leading to potential denial of service. Upgrading to version 2.12.0 mitigates this issue by disabling decompression of gzip-encoded HTTP requests regardless of header variations.