Executive brief
Apache NiFi is a data integration and workflow automation platform used for building real-time data pipelines. The affected versions contain a vulnerability where the REST API accepts gzip-compressed HTTP requests but enforces size limits on the compressed payload rather than the decompressed output. An attacker can send a small compressed request that expands to a very large uncompressed payload, causing the NiFi server to consume excessive memory and become unavailable to legitimate users.
Technical details
The vulnerability is an uncontrolled resource consumption flaw in the Jersey encoding filter used by Apache NiFi's REST API. The framework validates request sizes against the compressed payload, allowing attackers to bypass these limits by crafting gzip-encoded requests with high compression ratios. An attacker with network access to the REST API can send such requests without authentication requirements, causing the decompression process to exhaust server memory. The fix in version 2.11.0 disables automatic decompression of gzip-encoded HTTP requests and moves response compression handling to the Jetty server layer.
Affected products
- Apache NiFi 1.5.0 through 2.10.0
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Fixed in Apache NiFi 2.11.0