CVE-2026-70469: Apache NiFi DOS Vulnerability

CVE-2026-70469 Overview

CVE-2026-70469 affects Apache NiFi 2.11.0 and involves incomplete enforcement of a filter designed to reject gzip-encoded HTTP requests to the application REST API. The framework filter checks the Content-Encoding header but fails when a request includes multiple instances of the header or uses non-standard identifiers for gzip encoding. A malicious client can craft requests that bypass the filter and trigger server-side decompression, consuming excessive memory. This is categorized under [CWE-409] Improper Handling of Highly Compressed Data (Data Amplification), a resource exhaustion class of vulnerability.

Critical Impact
Remote clients can send crafted gzip-encoded HTTP requests to the Apache NiFi REST API and exhaust server memory, degrading availability.

Affected Products

Apache NiFi 2.11.0
Apache NiFi REST API framework enforcement filter
Deployments exposing the NiFi REST API to untrusted clients

Discovery Timeline

2026-09-16 - CVE-2026-70469 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-70469

Vulnerability Analysis

Apache NiFi 2.11.0 disabled decompression of gzip-encoded HTTP requests to the REST API. The framework introduced an enforcement filter that inspects the Content-Encoding header and rejects requests declaring gzip encoding. The filter implementation only handled the expected single-value case. Requests carrying more than one Content-Encoding header, or using non-standard tokens for gzip, passed the check. Downstream handlers then attempted to decompress the request body, allocating buffers proportional to the decompressed payload.

An attacker can submit a small compressed body that expands to a large in-memory representation. Repeated crafted requests drive memory pressure on the NiFi process, leading to degraded service or process termination.

Root Cause

The root cause is incomplete input validation in the request filter. The filter did not iterate all Content-Encoding header instances and did not normalize encoding identifiers before comparison. This left a bypass path for any request that split the header or used a non-standard alias for gzip.

Attack Vector

Exploitation requires network access to the NiFi REST API. The attacker sends HTTP requests with duplicated Content-Encoding headers or non-standard gzip identifiers, along with a highly compressible payload. Refer to the Apache Mailing List Thread and the Openwall OSS-Security Discussion for the vendor description.

No public proof-of-concept code is referenced in the advisory, so no exploitation code is reproduced here.

Detection Methods for CVE-2026-70469

Indicators of Compromise

HTTP requests to the NiFi REST API containing multiple Content-Encoding headers in a single request.
Requests with Content-Encoding values that are non-standard aliases for gzip rather than the canonical gzip token.
Sudden growth in Apache NiFi JVM heap usage or OutOfMemoryError events correlated with REST API traffic.

Detection Strategies

Inspect reverse proxy and web server access logs for REST API requests with duplicated or unusual Content-Encoding header values.
Add WAF or API gateway rules that normalize and count Content-Encoding headers before requests reach NiFi.
Correlate NiFi JVM memory metrics with request patterns to identify decompression-driven exhaustion attempts.

Monitoring Recommendations

Alert on repeated 5xx responses or process restarts on NiFi nodes serving the REST API.
Track request body size versus declared Content-Length ratios to surface amplification attempts.
Forward NiFi application logs and front-end proxy logs to a centralized analytics platform for correlation.

How to Mitigate CVE-2026-70469

Immediate Actions Required

Upgrade Apache NiFi to version 2.12.0, which disables decompression of gzip-encoded HTTP requests regardless of header count or encoding identifier.
Restrict network exposure of the NiFi REST API to trusted management networks until the upgrade is applied.
Enforce authentication and TLS client requirements on the REST API to limit anonymous request submission.

Patch Information

The Apache NiFi project has released version 2.12.0 as the fixed release. The 2.12.0 release removes reliance on the filter logic that was bypassable in 2.11.0 by refusing gzip decompression outright. See the Apache Mailing List Thread for the vendor announcement.

Workarounds

Place a reverse proxy in front of NiFi that strips or rejects requests containing any Content-Encoding header targeting the REST API.
Configure the proxy to enforce a single Content-Encoding header per request and to reject non-standard encoding tokens.
Apply per-client rate limits and maximum request body size limits on the proxy to reduce amplification impact.

bash

# Example NGINX snippet to strip Content-Encoding on requests to the NiFi REST API
location /nifi-api/ {
    proxy_set_header Content-Encoding "";
    client_max_body_size 10m;
    proxy_pass https://nifi_backend;
}