CVE-2026-70469

Apache NiFi 2.11.0 contains a resource-exhaustion flaw (CWE-409) in the framework enforcement filter that guards the application REST API. Although 2.11.0 disabled gzip request decompression and rejects requests carrying a standard Content-Encoding header identifying gzip, the filter fails to check for multiple instances of the header and does not reject non-standard or case-variant gzip identifiers. A malicious client can therefore submit crafted HTTP requests that bypass the filter and cause the server to decompress payloads, consuming excessive amounts of memory and leading to denial of service. Any deployment running Apache NiFi 2.11.0 with the REST API reachable by untrusted clients is affected, particularly instances exposed to the internet. No public proof-of-concept is known, the flaw is not in CISA KEV, and exploitation has not been confirmed; no CVSS score has been assigned yet.

What to do: Upgrade to Apache NiFi 2.12.0, which disables gzip decompression of HTTP requests regardless of the number of Content-Encoding headers or the encoding identifiers used. Until upgraded, restrict network access to the NiFi REST API so only trusted clients can reach it, and monitor listener memory usage for anomalous spikes that may indicate attempts to trigger the condition.