CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.

Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.

• NiFi 2.11.0 rejects gzip-encoded REST API requests but the enforcement filter misses duplicate Content-Encoding headers.
• Non-standard gzip identifiers also evade the filter, per Apache's High-severity rating.
• Affects org.apache.nifi:nifi-jetty 2.11.0; disclosed on oss-security by David Handermann.