CVE-2026-70469

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification) pada apache nifi. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

21 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/mjpv7r4djgn7fdvhnpjwgr2rcto47mx0 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/09/16/7 mailing list · advisory pihak ketiga