CVE-2026-70469: 
NixOS vulnerability analysis and mitigation

CVE-2026-70469 is a Denial of Service vulnerability in Apache NiFi 2.11.0, titled "Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests." The vulnerability affects only the org.apache.nifi:nifi-jetty component at version 2.11.0, which had previously disabled gzip-encoded HTTP request support for the REST API but failed to enforce this restriction comprehensively. It was reported on 2026-08-04 by researcher Minseong Kim (mak3bread) and publicly disclosed on 2026-09-16 via the Apache security mailing list. The CVSS category estimate is HIGH, though a precise numeric score has not yet been published at the time of this report (Apache Advisory, OSS-Sec).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). Apache NiFi 2.11.0 introduced a framework enforcement filter intended to reject gzip-encoded HTTP requests to the REST API, but this filter had two critical gaps: it did not account for multiple instances of the Content-Encoding header in a single request, and it did not reject non-standard or case-variant identifiers for gzip encoding (e.g., GZip, GZIP). An unauthenticated attacker can exploit these gaps by sending crafted HTTP requests with duplicate or non-standard Content-Encoding headers, causing the server to decompress the payload and consume excessive memory. The issue is tracked internally as NIFI-16170 (OSS-Sec, Apache Advisory).

Successful exploitation allows an unauthenticated remote attacker to cause the Apache NiFi server to consume excessive amounts of memory, resulting in a Denial of Service condition that could degrade or crash the NiFi REST API and disrupt data flow processing pipelines. Because NiFi is commonly used as a critical data integration and orchestration platform, availability impacts can have downstream effects on dependent systems and workflows. There is no evidence of confidentiality or integrity compromise from this vulnerability alone (Apache Advisory, OSS-Sec).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and is exploitable over the network, lowering the barrier for potential abuse, but the narrow version scope (only 2.11.0) limits the attack surface (Apache Advisory, OSS-Sec).

1. Reconnaissance: Identify Apache NiFi instances running version 2.11.0 exposed to the network, particularly those with the REST API accessible (default port 8443 or 8080). Tools such as Shodan or Censys can be used to locate internet-facing NiFi deployments.
2. Craft malicious HTTP request: Construct an HTTP POST or PUT request targeting a NiFi REST API endpoint (e.g., /nifi-api/) that includes either multiple Content-Encoding: gzip headers or a non-standard gzip identifier (e.g., Content-Encoding: GZip or Content-Encoding: GZIP) to bypass the enforcement filter.
3. Attach compressed payload: Include a highly compressed ("zip bomb" style) gzip payload in the request body — a small compressed file that expands to a very large amount of data upon decompression.
4. Send request: Transmit the crafted request to the NiFi REST API. The enforcement filter fails to reject the request due to the header bypass, causing the server to decompress the payload and allocate excessive memory.
5. Achieve DoS: Repeat the request as needed to exhaust server memory, causing the NiFi process to become unresponsive or crash, disrupting data flow operations (OSS-Sec, Apache Advisory).

• Network: Unusual HTTP requests to NiFi REST API endpoints (/nifi-api/) with multiple Content-Encoding headers or non-standard gzip identifiers (e.g., GZip, GZIP) from unexpected source IPs; high-volume or repeated requests with compressed bodies.
• Logs: NiFi application logs (nifi-app.log) showing repeated REST API requests with abnormal Content-Encoding header values; Java OutOfMemoryError or GC overhead limit exceeded errors in nifi-app.log or nifi-bootstrap.log.
• Process: Sudden spike in JVM heap memory usage by the NiFi process; NiFi becoming unresponsive or restarting unexpectedly; high CPU usage associated with garbage collection activity.

The recommended mitigation is to upgrade Apache NiFi to version 2.12.0, which disables decompression of gzip-encoded HTTP requests entirely, regardless of the number of Content-Encoding headers or the specific encoding identifier used. No configuration-based workaround has been officially documented for version 2.11.0. Organizations unable to upgrade immediately should consider placing a reverse proxy or WAF in front of the NiFi REST API configured to reject requests with multiple Content-Encoding headers or non-standard gzip identifiers (Apache Advisory, OSS-Sec).

The vulnerability was covered by SecurityOnline.info as part of a broader Apache NiFi security update summary, and was noted by the DailyCyberSecurity account on Infosec.Exchange (SecurityOnline). The Apache NiFi project credited researcher Minseong Kim (mak3bread) for responsible disclosure (OSS-Sec). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.