A vulnerability in Apache NiFi 2.11.0 allows for potential denial of service through memory exhaustion by sending specially crafted, gzip-encoded HTTP requests.

This is an improper handling of highly compressed data (CWE-409) vulnerability. An unauthenticated attacker can exploit the framework filter to bypass compression checks, leading to memory exhaustion on the target server.

The vulnerability carries a CVSS score of 7.5, reflecting its high potential for service disruption. Successful exploitation allows an attacker to cause an application crash or significant performance degradation, which directly impacts availability and business continuity for critical data flow operations.

Immediate Action: Upgrade to Apache NiFi 2.12.0 immediately, which effectively disables decompression for gzip-encoded HTTP requests to prevent this amplification attack.

Proactive Monitoring: Monitor server memory utilization and HTTP request logs for unusual traffic patterns or spikes in payload sizes associated with the REST API.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block malformed or suspicious HTTP requests that utilize multiple or non-standard Content-Encoding headers.

Public Exploit Available: No

Given the high CVSS score and the ease of exploitation, this issue poses a significant risk to the availability of Apache NiFi environments. Administrators must prioritize the transition to version 2.12.0 to eliminate the underlying vulnerability and protect their infrastructure from potential denial of service attacks.