Not rated
CVE-2018-17194 When a client request to a cluster node was replicated to other nodes in the cluster for verification, the…
Description
When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache NiFi | Versions not published |
Other CVEs of Apache NiFi
The 47 CVEs of Apache NiFi →
CVE-2026-70469
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests…
Not rated
CVE-2026-81866
Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not…
0.5
Low
CVE-2026-82561
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a…
5.9
Medium
CVE-2026-86089
Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API…
2.3
Low