CVE-2026-70469— Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Quick assessment
Affected
Apache Software Foundation Apache NiFi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache NiFi | 2.11.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-70469
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Source: CVE Program / CVE List V5
Vulnerability Description
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache NiFi | 2.11.0 | - |
|
II. Public POCs for CVE-2026-70469
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-70469
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-70469 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-16 · 20 CVEs total
| CVE-2026-87976 | 7.2 HIGH | Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles |
| CVE-2026-82561 | 5.9 MEDIUM | Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods |
| CVE-2026-86089 | 2.3 LOW | Apache NiFi: Missing Process Group Authorization for Connector Migration |
| CVE-2026-81866 | 0.5 LOW | Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configur |
| CVE-2026-86465 | Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via us | |
| CVE-2026-82311 | Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _us | |
| CVE-2026-86462 | Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed | |
| CVE-2026-86792 | Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Sched | |
| CVE-2026-82310 | Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API | |
| CVE-2026-76186 | Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session iden | |
| CVE-2026-76187 | Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session J | |
| CVE-2026-86466 | Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validate | |
| CVE-2026-59739 | Apache ZooKeeper: Information disclosure via SetWatches reconnect replay | |
| CVE-2026-59969 | Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode | |
| CVE-2026-79993 | Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion | |
| CVE-2026-84439 | Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources | |
| CVE-2026-84501 | Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationP | |
| CVE-2026-68536 | Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability | |
| CVE-2026-76646 | Apache MyFaces: Denial of Service via Unbounded Request Parsing |
IV. Related Vulnerabilities
Same product: Apache NiFi
-
CVE-2026-81866
Apache NiFi: Missing Authorization for Assets and Secrets Re -
CVE-2026-82561
Apache NiFi: Missing Authorization for Components Referenced -
CVE-2026-86089
Apache NiFi: Missing Process Group Authorization for Connect -
CVE-2026-68981
Apache NiFi: Uncontrolled Resource Consumption through Decom -
CVE-2026-68980
Apache NiFi: Authorization Bypass for Parameter Context Asse
Same vendor: Apache Software Foundation
-
CVE-2026-81866
Apache NiFi: Missing Authorization for Assets and Secrets Re -
CVE-2026-82561
Apache NiFi: Missing Authorization for Components Referenced -
CVE-2026-86089
Apache NiFi: Missing Process Group Authorization for Connect -
CVE-2026-87976
Apache NiFi Registry: Improper Limitation of Pathname in Per -
CVE-2026-76646
Apache MyFaces: Denial of Service via Unbounded Request Pars
Same weakness: CWE-409
-
CVE-2026-92000
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Decl -
CVE-2026-44163
fluent-plugin-opentelemetry: Denial of Service (DoS) via Lar -
CVE-2026-44162
fluent-plugin-s3: Denial of Service (DoS) via Decompression -
CVE-2026-53659
http4k: Unbounded gzip decompression in `ServerFilters.GZip` -
CVE-2026-5132
Unbounded zlib decompression in Calls SDP WebSocket messages
V. Comments for CVE-2026-70469
No comments yet