CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.

Database specific

{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-409"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68981.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "last_affected": "2.10.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "fixed": "2.10.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type

GIT

Repo

https://github.com/apache/nifi

Events

Introduced

46d30c7e92f0ad034d9b35bf1d05c350ab5547ed

Fixed

e296b299805a7e3ff4c99916b79cfba16c5e4870

Database specific

Show details

{
    "cpe": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "2.11.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68981.json"