PT-2026-117923

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present...

PT-2026-117712

Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...

PT-2026-117839

Security vulnerability affects the apache-nifi package. JLine is a Java library for handling console input...

PT-2026-117847

Security vulnerability affects the apache-nifi package. When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written...

PT-2026-117854

Security vulnerability affects the apache-nifi package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...

PT-2026-117913

Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes...

CVE-2026-106449 vulnerabilities

Vulnerabilities for packages: datahub-frontend, dd-trace-java, apache-nifi, pinot-fips, strimzi-kafka-operator-fips, sonarqube, conductor-fips, cruise-control-fips, elasticsearch, cassandra-fips, cruise-control, apache-polaris-fips, logstash-fips, akhq, datahub-gms, opensearch, apache-pulsar-fips...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: datahub-frontend, dd-trace-java, apache-nifi, pinot-fips, strimzi-kafka-operator-fips, sonarqube, conductor-fips, cruise-control-fips, elasticsearch, cassandra-fips, cruise-control, apache-polaris-fips, logstash-fips, akhq, datahub-gms, opensearch, apache-pulsar-fips...

GHSA-GM45-99XC-R7WV vulnerabilities

Vulnerabilities for packages: datahub-frontend, dd-trace-java, apache-nifi, pinot-fips, strimzi-kafka-operator-fips, sonarqube, conductor-fips, cruise-control-fips, elasticsearch, cassandra-fips, cruise-control, apache-polaris-fips, logstash-fips, akhq, datahub-gms, opensearch, apache-pulsar-fips...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: datahub-frontend, dd-trace-java, apache-nifi, pinot-fips, strimzi-kafka-operator-fips, sonarqube, conductor-fips, cruise-control-fips, elasticsearch, cassandra-fips, cruise-control, apache-polaris-fips, logstash-fips, akhq, datahub-gms, opensearch, apache-pulsar-fips...

GHSA-J9F9-W8PJ-32F8 vulnerabilities

Vulnerabilities for packages: datahub-gms, apache-nifi-registry...

CVE-2026-47890 vulnerabilities

Vulnerabilities for packages: datahub-gms, apache-nifi-registry...

CLEANSTART-2026-QH78239 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-BP29936 In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service DoS condition...

CLEANSTART-2026-AY31255 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame

Security vulnerability affects the apache-nifi-registry package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...

CLEANSTART-2026-GG30047 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns

Security vulnerability affects the apache-nifi-registry package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...

CLEANSTART-2026-DS55761 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the apache-nifi-registry package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

CLEANSTART-2026-IK05706 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the apache-nifi-registry package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-KL61134 application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store

Security vulnerability affects the apache-nifi-registry package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store...

CLEANSTART-2026-AM86994 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...

Security vulnerability affects the apache-nifi-registry package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...