Apache NiFi Flaw Enable Security Bypass and Memory Corruption

Gbhackers •Divya • August 4, 2026

Apache NiFi has issued security advisories for four vulnerabilities affecting its web API. These include an authorization bypass that could allow unauthorized deletion of Parameter Context assets, and a high-severity issue that results in excessive memory consumption through specially crafted gzip-compressed HTTP requests. The vulnerabilities impact Apache NiFi versions from 1.5.0 through 2.10.0, depending on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache NiFi Vulnerabilities Lead to Authorization Bypass and Memory Issues Apache NiFi has disclosed four critical vulnerabilities affecting its Web API and Parameter Context authorization controls. Users are urged to upgrade to version 2.11.0 to mitigate risks of authorization bypass, unauthorized configuration changes, and memory exhaustion. The vulnerabilities allow attackers to exploit the system via specially crafted gzip-compressed HTTP requests, leading to potential unauthorized deletion of assets and code execution in specific deployments. Affected versions range from 1.5.0 to 2.10.0. The vulnerabilities have been classified with high severity due to their potential impact on system integrity and availability. Users are advised to take immediate action to secure their installations. 2 sources 69

Extracted Entities

Platforms (1)

Apache NiFi