CyberRota Analysis
AI-GeneratedApache NiFi versions prior to 2.12.0 are vulnerable due to improper handling of multiple Content-Encoding headers, allowing attackers to send specially crafted gzip-encoded HTTP requests that can lead to excessive memory consumption. This vulnerability poses a risk of denial-of-service conditions, making it critical for organizations using affected versions to prioritize upgrading to 2.12.0 or later. Users managing Apache NiFi deployments should take immediate action to mitigate potential exploitation.
Original NVD Description
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and did not reject non-standard identifiers for gzip encoding, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which disables decompression of gzip-encoded HTTP requests regardless of header number or encoding identifiers.
Related CVEs
Other vulnerabilities affecting the same vendor(s)