Which versions of Apache NiFi are affected by CVE-2026-68981?

Apache NiFi REST API (versions 1.5.0-2.10.0) is vulnerable to unauthenticated denial-of-service attacks that can exhaust JVM memory and crash the service through crafted gzip-compressed payloads.

How to fix or mitigate CVE-2026-68981?

Within 24 hours, inventory all Apache NiFi instances in production and map those with exposed REST API endpoints to the network. Within 7 days, implement network-level access controls restricting REST API endpoints to trusted source IPs only, enforce rate limiting on API requests, and deploy request size caps for gzip-compressed payloads at the load balancer or WAF layer. Within 30 days, establish a monitoring process for Apache NiFi security advisories and prepare an upgrade strategy for when patches are released; prioritize instances handling sensitive or mission-critical data workflows.

Apache NiFi CVE-2026-68981

Q: What is the CVSS score of CVE-2026-68981?

CVE-2026-68981 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Amber. EPSS exploitation probability: 0.3%.

EUVD-2026-52423 HIGH

Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)

2026-08-03

GHSA-w96g-mj2p-wqjv

Apache Information Disclosure Nifi

8.8

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Amber

vuln.today AI

7.5 HIGH

Unauthenticated network access to a default-enabled REST API endpoint; impact is availability-only per the description; confidentiality and integrity impacts are not substantiated by the documented behavior.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 20:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Aug 03, 2026 - 20:22 NVD

8.8 (HIGH)

Analysis Generated

Aug 03, 2026 - 20:16 vuln.today

CVE Published

Aug 03, 2026 - 19:58 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 5 New Apache Vulnerabilities - 5 High Severity, 2 With POC Aug 04, 2026

AnalysisAI

Uncontrolled decompression in Apache NiFi 1.5.0 through 2.10.0 exposes the REST API to unauthenticated denial-of-service attacks via crafted gzip payloads. The Jersey encoding filter enforces its configurable size limit against the compressed form of the request body rather than the decompressed output, enabling a classic zip-bomb condition that can exhaust JVM heap memory. No public exploit has been identified at time of analysis, but the CVSS 4.0 supplemental metadata flags the attack as automatable (AU:Y) with Amber utility, indicating meaningful real-world risk against organizations with network-accessible NiFi REST API endpoints.

Technical ContextAI

Apache NiFi's REST API is built on the Jersey (JAX-RS) framework and includes a gzip encoding filter that transparently decompresses inbound HTTP request bodies bearing a Content-Encoding: gzip header. The root cause is CWE-409 (Improper Handling of Highly Compressed Data): the application's configurable maximum request size guard evaluates the compressed payload size prior to decompression, not after. This ordering allows an attacker to craft a zip-bomb-a small compressed body that expands at an extreme ratio during decompression-bypassing the size guard entirely and forcing the JVM to allocate heap proportional to the decompressed output. The fix in version 2.11.0 removes the Jersey decompression filter and migrates compression handling to Jetty Server, which enforces limits post-decompression and disables gzip decoding of inbound requests entirely, eliminating the attack surface at the framework level.

RemediationAI

Upgrade to Apache NiFi 2.11.0, the vendor-confirmed fix version per the oss-security advisory at https://seclists.org/oss-sec/2026/q3/399 and Apache Jira NIFI-16152. The upgrade removes the Jersey gzip decoding filter and moves compression to Jetty Server with correct post-decompression size enforcement, fully eliminating the vulnerable code path. If an immediate upgrade is not feasible, deploy a reverse proxy or WAF in front of the NiFi REST API configured to strip or reject inbound Content-Encoding: gzip headers - note this will break any legitimate clients that send compressed request bodies, so client impact must be assessed. Network-level access controls that restrict REST API port access (default 8080 or 8443) to trusted IP ranges reduce exposure but do not eliminate the vulnerability for authorized internal clients. Adjusting the existing NiFi configurable maximum request size setting is not an effective workaround because it evaluates the compressed payload size before decompression occurs.