CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.
Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.
- NiFi 2.11.0 rejects gzip-encoded REST API requests but the enforcement filter misses duplicate Content-Encoding headers.
- Non-standard gzip identifiers also evade the filter, per Apache's High-severity rating.
- Affects org.apache.nifi:nifi-jetty 2.11.0; disclosed on oss-security by David Handermann.
- CVEs
- CVE-2026-70469
- Vendors
- Apache
- Products
- Apache NiFi
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-70469 | Memory-exhaustion DoS via crafted Content-Encoding headers in Apache NiFi 2.11.0 | 7.5 | — |
From the original article
Posted by David Handermann on Sep 16 Severity: High Affected versions: - Apache NiFi (org. apache. nifi:nifi-jetty) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.