(nifi-site) 05/05: NIFI-16152 Published CVE-2026-68981

[ex...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

exceptionfactory pushed a commit to branch main-staging
in repository https://gitbox.apache.org/repos/asf/nifi-site.git

commit 889cc6314fca4a4804057730043ff054a60fa1d6
Author: exceptionfactory <ex...@apache.org>
AuthorDate: Mon Aug 3 15:13:46 2026 -0500

    NIFI-16152 Published CVE-2026-68981
    
    (cherry picked from commit 7f7c073b5db707e95e2721bffe1d7264f68bf7de)
---
 content/documentation/security.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/content/documentation/security.md b/content/documentation/security.md
index 16982094..553a8a70 100644
--- a/content/documentation/security.md
+++ b/content/documentation/security.md
@@ -71,6 +71,24 @@ Severity ratings represent the determination of project members based on an eval
 
 The following announcements include published vulnerabilities that apply directly to Apache NiFi components.
 
+{{< vulnerability
+id="CVE-2026-68981"
+title="Uncontrolled Resource Consumption through Decompression of HTTP Requests"
+published="2026-08-03"
+severity="High"
+products="Apache NiFi"
+affectedVersions="1.5.0 to 2.10.0"
+fixedVersion="2.11.0"
+jira="NIFI-16152"
+pullRequest="11489"
+reporter="mak3bread (Minseong Kim)" >}}
+
+Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the
+compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the
+recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
+
+{{</ vulnerability >}}
+
 {{< vulnerability
 id="CVE-2026-68980"
 title="Authorization Bypass for Parameter Context Asset Deletion"