Login Request a demo
High severity · published Aug 3, 2026
CVE-2026-68981
Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Apache NiFi · Apache Software Foundation
1.5.0 through 2.10.0 · source: vendor
NI
Nifi · Apache
1.5.0 before 2.11.0 · source: NVD
Affected product
AN
Apache NiFi
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68981
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-68981
Mailing List
https://lists.apache.org/thread/vxrqn7poyf1wx6gdy7c0dxqfqkctjngg
Mailing List
http://www.openwall.com/lists/oss-security/2026/08/03/13
More from Apache NiFi
9.8
CVE-2026-68979
Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
9.1
CVE-2026-68980
Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
8.8
CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
7.5
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
7.2
CVE-2026-44914
Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents