Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation

Summary MiNiFi - a subproject of Apache NiFi - is a complementary data collection approach that supplements the core tenets of NiFi in dataflow management, focusing on the collection of data at the source of its creation. Description Apache NiFi MiNiFi C++ contain an uncontrolled memory allocatio...

Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation

Apache NiFi MiNiFi C++ versions 1.0.0 and 0.99.2 contain an uncontrolled memory allocation issue in the InputStream reader. A length field from a site-to-site or C2 stream can cause an oversized allocation and crash the agent. // // // Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation /...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-bootstrap (>=2.0.0-m1, <=2.0.0-m2) +46 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-runtime-manifest-core (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-runtime-manifest-core MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m2 - org.apache.nifi.minifi:minifi-toolkit-encrypt-config 2.0.0-m2 and more Source cves: CVE-2026-44914 Source advisory:...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +27 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-core (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-framework-core MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875414...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-bom (>=2.4.0, <=2.8.0) +54 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-core-api (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-framework-core-api MAVEN version =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.0.0-m2, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.4.0, =2.8.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875412...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +35 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-stateless-engine (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-stateless-engine MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875416...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.8.0), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +36 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-framework-components (>=2.0.0-m1, <=2.9.0)

org.apache.nifi:nifi-framework-components MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0 and more Source cves: CVE-2026-44914 Source advisory: SNYK:JAVA-ORGAPACHENIFI-17875411...

CVE-2021-33191

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command ...

EUVD-2021-19906

Malware in sbrugna...

EUVD-2023-45697

Malicious code in bioql PyPI...

CVE-2023-41180

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default,...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.0.0-m4), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +26 more potentially affected by CVE-2024-52067 via org.apache.nifi:nifi-framework-core (>=2.0.0-m1, <=2.0.0-m4)

org.apache.nifi:nifi-framework-core MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m4 and more Source cves: CVE-2024-52067 Source advisory: OSV:GHSA-V3VC-6QCV-4VRX...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.0.0-m4), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +26 more potentially affected by CVE-2024-52067 via org.apache.nifi:nifi-framework-core (>=2.0.0-m1, <=2.0.0-m4)

org.apache.nifi:nifi-framework-core MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m4 and more Source cves: CVE-2024-52067 Source advisory: GHSA-V3VC-6QCV-4VRX...

org.apache.nifi.minifi:minifi-assembly (>=1.22.0, <=1.28.0), org.apache.nifi.minifi:minifi-c2-assembly (>=1.22.0, <=1.28.0) +13 more potentially affected by CVE-2024-52067 via org.apache.nifi:nifi-framework-core (>=1.16.0, <=1.28.0)

org.apache.nifi:nifi-framework-core MAVEN version =1.16.0, =1.22.0, =1.22.0, =1.22.0, =1.22.0, =1.22.0, =1.22.0, =1.22.0, =1.22.0, =1.22.0, =1.17.0, =1.17.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.28.0 Source cves: CVE-2024-52067 Source advisory: GHSA-V3VC-6QCV-4VRX...

org.apache.nifi.minifi:minifi-assembly (>=2.0.0-m1, <=2.0.0-m4), org.apache.nifi.minifi:minifi-c2-assembly (2.0.0-m1) +26 more potentially affected by CVE-2024-52067 via org.apache.nifi:nifi-framework-core (>=2.0.0-m1, <=2.0.0-m4)

org.apache.nifi:nifi-framework-core MAVEN version =2.0.0-m1, =2.0.0-m1, =2.0.0-m2, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m1, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m3, =2.0.0-m4 and more Source cves: CVE-2024-52067 Source advisory: MEND:CVE-2024-52067...

Apache NiFi MiNiFi InvokeHTTP Component Data Compromise

The vulnerability of the InvokeHTTP component in the Apache NiFi MiNiFi data processing platform exists due to insufficient verification of certificate authenticity. Exploiting this vulnerability allows an attacker to compromise data integrity from a remote location...

CVE-2023-41180

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default,...

Default credentials

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default,...

CVE-2023-41180

Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TLS handshake negotation. The Disable Peer Verification property of InvokeHTTP was effectively flipped, disabling verification by default,...

CVE-2023-41180

CVE-2023-41180 affects Apache NiFi MiNiFi C++: InvokeHTTP in versions 0.13 to 0.14 has incorrect certificate validation, allowing an intermediary to present a forged certificate during TLS handshake because the Disable Peer Verification setting was effectively flipped, disabling verification by d...