Homepage

Improper Handling of Highly Compressed Data (Data Amplification) Affecting apache-nifi package, versions <2.12.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.53% (44th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-APACHENIFI-20047403
  • published23 Sept 2026
  • disclosed16 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 16 Sep 2026

NewCVE-2026-70469  (opens in a new tab)
CWE-409  (opens in a new tab)

How to fix?

Upgrade Minimos:latest apache-nifi to version 2.12.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache-nifi package and not the apache-nifi package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.