Executive brief
Apache NiFi is a data routing and transformation system used in data pipelines and workflow automation. Version 2.11.0 introduced a flaw where the REST API did not properly validate gzip encoding headers, allowing an attacker to send crafted HTTP requests that bypass content validation and consume excessive server memory, potentially causing denial of service.
Technical details
The vulnerability exists in NiFi 2.11.0's framework enforcement filter for the REST API. The filter fails to properly handle multiple instances of the Content-Encoding header and does not reject non-standard gzip encoding identifiers, allowing an attacker to construct requests that trigger decompression logic in ways that consume excessive memory. The attack is network-accessible and requires no authentication or user interaction. An attacker can send crafted gzip-encoded requests to exhaust server memory and cause denial of service. The vulnerability is patched in Apache NiFi 2.12.0, which disables gzip decompression for HTTP requests regardless of header variations.
Affected products
- Apache NiFi 2.11.0
Timeline
- 2026-09-16: disclosed
- 2026: patched: Fixed in Apache NiFi 2.12.0