As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi 2.11.0 fails to properly validate the Content-Encoding header in HTTP requests to its REST application programming interface (API), allowing requests with gzip encoding or non-standard identifiers to bypass filtering. The framework's enforcement mechanism does not check for multiple header instances or reject variant gzip identifiers, creating a potential bypass vulnerability.
Why it matters: Organizations running Apache NiFi 2.11.0 should assess whether this header validation bypass could allow attackers to deliver unexpected payloads to the REST API, potentially leading to remote code execution (RCE) or data access, and apply available patches or mitigations promptly.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi 2.11.0 improperly handles case sensitivity and multiple instances of the Content-Encoding header in HTTP requests to its application programming interface (API), allowing requests with gzip encoding to bypass the REST API's enforcement filter. The vulnerability stems from the framework's failure to validate non-standard gzip identifiers and multiple header instances. CVE-2026-70469 carries a CVSS 3.1 score of 7.5.
Why it matters: Organizations running Apache NiFi 2.11.0 should assess whether this bypass affects their REST API security controls and apply vendor guidance to prevent unauthorized request encoding manipulation.
- Source published
- First seen by Cybersecurity Tracker