Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
Apache NiFi LZ4 compression may allow data tampering
published 9 days ago
Summary
The LZ4 compression library used by Apache NiFi can be tricked into processing specially crafted data, which could let an attacker alter or corrupt information. This could affect any NiFi flows that use this compression feature. Update to the latest NiFi version or apply the vendor’s recommended patch to resolve the risk.
What to do
- Update cleanstart apache-nifi to version 2.11.0-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-nifi |
< 2.11.0-r1 Fix: upgrade to 2.11.0-r1
|
Original advisory text
yawkat LZ4 Java provides LZ4 compression for Java
Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published10 Oct 2026
Updated10 Oct 2026
First seen10 Oct 2026
Sources
CLEANSTART-2026-EA15585 · OSV
Track software like this
Free during beta