CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.
Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.
- NiFi 2.11.0 rejects gzip-encoded REST API requests but the enforcement filter misses duplicate Content-Encoding headers.
- Non-standard gzip identifiers also evade the filter, per Apache's High-severity rating.
- Affects org.apache.nifi:nifi-jetty 2.11.0; disclosed on oss-security by David Handermann.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-70469 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by David Handermann on Sep 16 Severity: High Affected versions: - Apache NiFi (org.apache.nifi:nifi-jetty) 2.11.0 Description: Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip...
This source does not provide full text. Read it at seclists.org.