GHSA-8vm2-c32j-mvfr

Suggest an improvement
Source
https://github.com/advisories/GHSA-8vm2-c32j-mvfr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8vm2-c32j-mvfr/GHSA-8vm2-c32j-mvfr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8vm2-c32j-mvfr
Aliases
Downstream
Published
2026-06-22T09:30:45Z
Modified
2026-09-11T22:15:04Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/S:N/AU:Y/R:A/V:D/RE:L/U:Green CVSS Calculator
Summary
Apache NiFi fails to validate proxy host headers when constructing qualified URLs
Details

Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in the HTTP Host header, but did not apply the validation to alternative Proxy and Forwarded headers. The absence of proxy host header validation allowed a client to instruct Apache NiFi web services to construct invalid qualified URLs for redirection or data references. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which implements validation for the X-ProxyHost and X-Forwarded-Host HTTP request headers based on the nifi.web.proxy.host property. Enabling header validation requires configuring the application with HTTPS. Reverse proxy servers in front of Apache NiFi are responsible for filtering input request headers and providing allowed values to the application.

Database specific 
{
    "cwe_ids": [
        "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T22:10:44Z",
    "nvd_published_at": "2026-06-22T08:17:07Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.apache.nifi:nifi-jetty

Package

Name
org.apache.nifi:nifi-jetty
View open source insights on deps.dev
Purl
pkg:maven/org.apache.nifi/nifi-jetty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.10.0

Affected versions

0.*
0.0.1-incubating
0.0.2-incubating
0.1.0-incubating
0.2.0-incubating
0.2.1
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
1.*
1.0.0-BETA
1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
1.9.2
1.10.0
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.14.0
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
1.16.1
1.16.2
1.16.3
1.17.0
1.18.0
1.19.0
1.19.1
1.20.0
1.21.0
1.22.0
1.23.0
1.23.1
1.23.2
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
2.*
2.0.0-M1
2.0.0-M2
2.0.0-M3
2.0.0-M4
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.8.0
2.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-8vm2-c32j-mvfr/GHSA-8vm2-c32j-mvfr.json"