CVE-2026-68981: 
NixOS vulnerability analysis and mitigation

CVE-2026-68981 is a Denial of Service vulnerability in Apache NiFi caused by improper handling of highly compressed HTTP request data (decompression bomb). Affecting Apache NiFi versions 1.5.0 through 2.10.0, the flaw was reported on 2026-07-28 by researcher Minseong Kim (mak3bread) and publicly disclosed on 2026-08-03 via the Apache security mailing list. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, OSS-Security).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). Apache NiFi's REST API accepted gzip-encoded HTTP requests via a Jersey encoding filter, but enforced the configurable maximum request size limit against the compressed payload size rather than the decompressed output size. This allowed an unauthenticated remote attacker to craft a small gzip-compressed request that decompresses to a vastly larger payload, consuming excessive JVM heap memory. No authentication or special privileges are required, and the attack is network-accessible with low complexity (OSS-Security, GitHub Advisory).

Successful exploitation causes uncontrolled memory consumption in the Apache NiFi process, potentially crashing the service and causing a complete denial of availability for data flow operations managed by NiFi. There is no direct confidentiality or integrity impact on the vulnerable system itself under the CVSSv3 assessment, though the CVSSv4 assessment notes minor confidentiality and integrity impacts. Because NiFi is commonly used as a critical data pipeline and workflow orchestration platform, service disruption can have significant downstream effects on dependent systems and data processing pipelines (GitHub Advisory, OSS-Security).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Apache Advisory). The vulnerability is rated as automatable (AU:Y in CVSSv4), meaning it can be exploited at scale without human interaction. The EPSS score is approximately 0.32–0.52%, placing it in roughly the 42nd percentile for exploitation probability within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Credit for discovery goes to Minseong Kim (mak3bread) (OSS-Security, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Apache NiFi instances running versions 1.5.0 through 2.10.0 using tools like Shodan or Censys, targeting the NiFi REST API port (typically 8080 or 8443).
2. Craft decompression bomb: Create a gzip-compressed HTTP request body that compresses to a size below the configured NiFi maximum request size limit but decompresses to a payload many times larger (e.g., a file filled with repeated bytes compressed to a few KB that expands to hundreds of MB).
3. Send crafted request: Submit the malicious gzip-encoded HTTP request to any REST API endpoint that accepts a request body, including the Content-Encoding: gzip header to trigger Jersey filter decompression.
4. Trigger memory exhaustion: The Jersey encoding filter decompresses the payload without enforcing limits on the decompressed size, causing the NiFi JVM to allocate excessive heap memory.
5. Achieve denial of service: Repeated or sufficiently large requests exhaust available JVM heap, triggering OutOfMemoryError and crashing or severely degrading the NiFi service (OSS-Security, GitHub Advisory).

• Network: Unusual HTTP POST/PUT requests to NiFi REST API endpoints with Content-Encoding: gzip headers from unexpected or untrusted source IPs; high-volume or repeated compressed requests to the NiFi API.
• Logs: NiFi application logs (nifi-app.log) showing OutOfMemoryError or heap exhaustion errors; Jetty/Jersey access logs recording large numbers of requests with gzip content encoding from a single source.
• Process: Sudden spike in JVM heap usage visible in NiFi's built-in monitoring or external JVM monitoring tools (e.g., JMX metrics); NiFi process crash or restart events.
• System: Operating system-level memory exhaustion alerts; NiFi service restart entries in system logs (e.g., systemd journal or init logs).

The primary remediation is to upgrade Apache NiFi to version 2.11.0 or later, which relocates response compression handling to the Jetty Server layer and disables decompression of gzip-encoded HTTP requests in the REST API, eliminating the vulnerable code path entirely (Apache Advisory, OSS-Security). As a temporary workaround for organizations unable to upgrade immediately, restricting network access to the NiFi REST API to trusted clients only (via firewall rules, network segmentation, or reverse proxy access controls) significantly reduces the attack surface. The issue is tracked as NIFI-16152 in the Apache Jira.

The vulnerability received coverage from several cybersecurity news outlets including GBHackers, CyberPress, CyberSecurityNews, and SecurityOnline shortly after disclosure, with articles noting the broader context of multiple Apache NiFi web API security fixes released simultaneously (GBHackers, SecurityOnline). The DailyCyberSecurity Mastodon account also highlighted the vulnerability. Community reaction has been measured, consistent with a denial-of-service class vulnerability with no known active exploitation.