Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

1 source · 5 articlesFirst reported Updated ()3
Merged summary · from the lead articleSummaries by Vani AI

Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.

Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.

Key facts
  • NiFi 2.11.0 rejects gzip-encoded REST API requests but the enforcement filter misses duplicate Content-Encoding headers.
  • Non-standard gzip identifiers also evade the filter, per Apache's High-severity rating.
  • Affects org.apache.nifi:nifi-jetty 2.11.0; disclosed on oss-security by David Handermann.
Analyze CVE-2026-70469 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-70469CVE-2026-87976CVE-2026-82561CVE-2026-86089CVE-2026-81866
Vendors
ApacheApache Software Foundation
Products
Apache NiFiApache NiFi Registry
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · Sep 16, 2026 oss-securityFirst report

    CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

    Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.

  2. · Sep 16, 2026 oss-security

    CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

    Apache NiFi 2.9.0-2.11.0 Connector configuration update and verification APIs skip authorization for referenced Assets and Secrets (CVE-2026-81866, Low).

  3. · Sep 16, 2026 oss-security

    CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

    Apache NiFi 1.5.0-2.11.0 flow update REST methods lack authorization checks for referenced components, permitting unauthorized Process Group flow replacement (CVE-2026-82561).

  4. · Sep 16, 2026 oss-security

    CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration

    Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).

  5. · Sep 16, 2026 oss-security

    CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

    Apache NiFi Registry 0.4.0-2.11.0 allows path manipulation when storing extension bundle content from uploaded NAR manifests (CVE-2026-87976, High).

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-70469
+4 related CVEs
CVE-2026-87976CVE-2026-82561CVE-2026-86089CVE-2026-81866
Memory-exhaustion DoS via crafted Content-Encoding headers in Apache NiFi 2.11.0
7.5
group max
—