CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

As cited

Copy frozen at 2026-09-17 01:51 UTC (site build).

vulnerabilities

CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi 2.11.0 fails to properly validate the Content-Encoding header in HTTP requests to its REST application programming interface (API), allowing requests with gzip encoding or non-standard identifiers to bypass filtering. The framework's enforcement mechanism does not check for multiple header instances or reject variant gzip identifiers, creating a potential bypass vulnerability.

Why it matters: Organizations running Apache NiFi 2.11.0 should assess whether this header validation bypass could allow attackers to deliver unexpected payloads to the REST API, potentially leading to remote code execution (RCE) or data access, and apply available patches or mitigations promptly.

Source published

2026-09-16 15:13 UTC

First seen by Cybersecurity Tracker

2026-09-16 17:33 UTC