CVE-2026-68981

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-68981

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68981.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-68981

Downstream

MINI-8p3q-3p5f-vx3q

Published

2026-08-03T19:59:58.955Z

Modified

2026-08-08T03:48:19.183694148Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Amber CVSS Calculator

Summary

Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Details

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "last_affected": "2.10.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "1.5.0"
                },
                {
                    "fixed": "2.10.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68981.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-409"
    ]
}

References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type

GIT

Repo

https://github.com/apache/nifi

Events

Introduced

46d30c7e92f0ad034d9b35bf1d05c350ab5547ed

Fixed

e296b299805a7e3ff4c99916b79cfba16c5e4870

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.5.0"
        },
        {
            "fixed": "2.11.0"
        }
    ],
    "cpe": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68981.json"