EUVD-2026-81079
GHSA-56vg-25rp-h2c5
Severity by source
Remote crafted HTTP request to REST API with low complexity; availability-only memory-exhaustion impact (C:N/I:N/A:H); PR:N assumed since the enforcement filter plausibly runs before auth, though this is uncertain.
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Memory-exhaustion denial of service in Apache NiFi 2.11.0 allows unauthenticated remote attackers to force the server to decompress gzip-encoded HTTP request bodies through the application REST API, potentially exhausting heap and degrading or halting the service. The release nominally disabled gzip request decompression via a framework enforcement filter, but that filter fails to inspect multiple Content-Encoding header instances and fails to reject non-standard or mixed-case gzip identifiers, so crafted requests slip through and are decompressed anyway. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Target must be running Apache NiFi exactly at version 2.11.0, which had gzip request decompression nominally disabled via a framework enforcement filter; the flaw is that this filter fails to inspect multiple Content-Encoding header instances and fails to reject non-standard/mixed-case gzip identifiers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a memory-exhaustion denial-of-service issue, not a code-execution or data-exposure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache NiFi 2.12.0, which disables decompression of gzip-encoded HTTP requests regardless of the number of Content-Encoding headers or the encoding identifier used, and which is the mitigation recommended by the project (see https://nifi.apache.org/ and https://issues.apache.org/jira/browse/NIFI-16170, resolved with fix version 2.12.0 via pull request #11509). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache NiFi 2.11.0 instances, confirm whether their REST APIs are reachable from untrusted networks, and immediately restrict access to trusted management networks or place them behind an authenticated reverse proxy; enable heap and request-size monitoring and alerting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today