Listen to this Post
How CVE-2026-68981 Works
Apache NiFi versions 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API through a Jersey encoding filter. The vulnerability arises from a critical design flaw in how the framework enforces request size limits. The system checks the `Content-Length` and applies the configurable maximum request size against the compressed payload rather than the decompressed output that the application actually processes. This allows a malicious actor to send a crafted gzip-compressed request that appears small on the wire—easily bypassing size restrictions—but expands to an enormous size (a “decompression bomb” or “zip bomb”) once NiFi decompresses it. The Jersey filter processes this compressed content without properly accounting for the difference between compressed and decompressed data sizes. When the server attempts to decompress the payload, it allocates memory for the full expanded data, potentially exhausting all available heap or system memory. This uncontrolled resource consumption can lead to application instability, severe performance degradation, and ultimately a denial-of-service condition where the NiFi instance becomes unresponsive or crashes. The attack can be launched remotely, requires no authentication or user interaction, and has low attack complexity. The issue is tracked under Jira NIFI-16152 and was discovered by security researcher mak3bread (Minseong Kim).
DailyCVE Form
Platform: Apache NiFi
Version: 1.5.0 – 2.10.0
Vulnerability : Decompression Bomb (CWE-400)
Severity: High (CVSS 8.6)
date: 2026-08-03
Prediction: 2026-08-04 (2.11.0 released)
What Undercode Say
Analytics from the Apache NiFi security team and third-party researchers indicate that this vulnerability is highly dangerous in multi-tenant or public-facing deployments. The CVSS v3 base score is 8.6 (High) with the vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. The EPSS score is approximately 0.32, indicating a moderate likelihood of exploitation in the wild. A CVSS v4 score of 8.8 has also been assigned. The core weakness is mapped to CWE-400: Uncontrolled Resource Consumption and specifically CWE-409: Improper Handling of Highly Compressed Data (Data Amplification). The attack maps to MITRE ATT&CK technique T1499.004 (Endpoint Denial of Service). Upgrading to Apache NiFi 2.11.0 is the only complete mitigation, as it relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests entirely.
Check current NiFi version ./bin/nifi.sh status Download and upgrade to NiFi 2.11.0 (recommended) wget https://downloads.apache.org/nifi/2.11.0/nifi-2.11.0-bin.zip unzip nifi-2.11.0-bin.zip Stop current instance, replace binaries, restart ./bin/nifi.sh stop cp -r nifi-2.11.0/ /opt/nifi/ ./bin/nifi.sh start Verify fix (check if gzip decompression is disabled) curl -I -H "Accept-Encoding: gzip" http://localhost:8080/nifi-api/process-groups If response is not gzip-encoded, mitigation is active
(Educational/Testing Only) Simulate a decompression bomb request Create a highly compressed payload (10MB compressed -> 10GB decompressed) dd if=/dev/zero bs=1M count=10 | gzip > bomb.gz Send to NiFi REST API (vulnerable versions only) curl -X POST -H "Content-Encoding: gzip" --data-binary @bomb.gz \ http://vulnerable-nifi:8080/nifi-api/process-groups/root/input-ports Warning: This will likely crash a vulnerable instance
Exploit
An attacker can exploit CVE-2026-68981 by sending a single HTTP POST or PUT request to any NiFi REST API endpoint that accepts a gzip-encoded body. The attacker crafts a small compressed payload (e.g., 10-100 KB) that decompresses to hundreds of megabytes or even gigabytes of data. Because NiFi enforces the `maxRequestSize` property only on the compressed size, this payload bypasses the limit. The server then attempts to decompress the entire payload into memory, triggering an OutOfMemoryError or exhausting the JVM heap. This causes the NiFi web API to become unresponsive, dropping all legitimate requests and potentially crashing the entire JVM process. The attack requires no credentials, can be executed from any network-reachable client, and has no rate-limiting bypass—a single crafted request is often sufficient to cause a denial of service.
Protection
- Immediate Upgrade: Upgrade to Apache NiFi 2.11.0 or later immediately. This version disables gzip decompression for incoming REST API requests entirely, eliminating the attack surface.
- Network-Level Mitigations (temporary if upgrade is not possible):
– Deploy a reverse proxy (e.g., NGINX, HAProxy) in front of NiFi.
– Configure the proxy to strip the `Content-Encoding: gzip` header from all requests to /nifi-api/.
– Alternatively, configure the proxy to reject requests with `Content-Encoding: gzip` or enforce strict size limits on the decompressed body using a Web Application Firewall (WAF).
3. JVM Heap Tuning: Increase JVM heap size (-Xmx) as a temporary buffer, but this does not prevent the attack—it only raises the threshold for crashing.
4. Monitoring: Implement monitoring for sudden spikes in memory usage or JVM garbage collection activity. Alert on repeated requests with `Content-Encoding: gzip` to `/nifi-api/` endpoints.
Impact
- Availability (High): Successful exploitation leads to uncontrolled memory consumption, causing the NiFi service to become unresponsive, crash, or enter an unstable state. This results in a complete denial of service (DoS) for all NiFi users and automated data flows.
- Confidentiality & Integrity (Low): While primarily a DoS vulnerability, memory exhaustion can cause unpredictable behavior, potentially leading to data corruption or exposure in edge cases.
- Operational Disruption: In production environments, this can halt critical data pipeline operations, ETL processes, and real-time data ingestion, leading to significant business impact.
- No Privilege Escalation: The attack does not grant the attacker any additional privileges or system access; it purely exhausts resources.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
