Uncontrolled resource consumption via HTTP decompression in Apache NiFi (CVE-2026-68981)

Apache NiFi enforced its maximum request size limit on the compressed payload of gzip-encoded HTTP requests rather than on the decompressed output. A malicious client can exploit this to send crafted requests that consume excessive amounts of memory through the application REST API. Affected versions: - Apache NiFi (org.apache.nifi:nifi-web-api) 1.5.0 through 2.10.0 We recommend updating to: Apache NiFi 2.11.0. CVSS 8.8 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q3/399 Details: https://vuln.today/cve/CVE-2026-68981