CVE-2026-68981

High

Description

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.

SeverityHigh

CVSS7.5

Exploit probability—

Product

Apache Nifi

PublishedAug 3, 2026

First seenAug 3, 2026

Weakness typeCWE-409CWE-409

How to fix

Update

apache nifi2.11.0 or later

Vendor advisories

lists.apache.org/thread/vxrqn7poyf1wx6gdy7c0dxqfqkctjngg

Affected products

Product	Affected versions	Fixed in
apache nifi	1.5.0 ≤ v < 2.11.0	2.11.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.