← Advisories

Apache NiFi MiNiFi C++ 1.0.0 Uncontrolled Memory Allocation

Low

Advisory ID

ZSL-2026-6029

Release Date

22 October 2026

Vendor

The Apache Software Foundation - https://www.apache.org

Affected Version

1.0.0, 0.99.2

CVE

N/A

Tested On

Microsoft Windows 10 (x86-64), g++ 15.2.0 (MSYS2 UCRT64)

Summary

MiNiFi - a subproject of Apache NiFi - is a complementary data collection approach that supplements the core tenets of NiFi in dataflow management, focusing on the collection of data at the source of its creation.

Description

Apache NiFi MiNiFi C++ contain an uncontrolled memory allocation in its InputStream reader: a length field read from a site-to-site or C2 stream is used to size a std::vector with no upper bound, so a peer that advertises a ~4 GB length forces an allocation that throws std::bad_alloc and crashes the agent. Site-to-site peers and C2 servers are treated as trusted and TLS is expected for production deployments, so TLS with peer verification prevents an untrusted party from reaching the reader.

/core-framework/src/io/InputStream.cpp:50-86
---------------------------------------------
size_t InputStream::read(std::string &str, bool widen) {
  uint32_t string_length = 0;
  ...
  length_return = read(string_length); // <-- 32-bit length straight off the wire (up to 0xFFFFFFFF)
  ...
  str.reserve(string_length); // <-- reserve up to 4 GB
  size_t bytes_to_read{string_length};
  while (bytes_to_read > 0) {
    std::vector<std::byte> buffer(bytes_to_read); // <-- allocation of the peer-controlled size (4 GB)
    const auto read_return = read(buffer);
    ...
    bytes_to_read -= read_return;
    str.append(...);
  }
}

Proof of Concept

nifiminifi.cppTXT

Disclosure Timeline

13.08.2026Vulnerability discovered.

19.08.2026Contact with the vendor.

20.08.2026Vendor forwards details to appropriate PMC.

24.08.2026Vendor reviews the issue, stating that it does not reach the level of vulnerability, and will be addressed as a defense-in-depth hardening measure.

24.08.2026Replied to the vendor.

22.10.2026Public security advisory released.

Credits

Vulnerability discovered by Gjoko Krstic

References

[1]https://nifi.apache.org/projects/minifi

Changelog

22.10.2026Initial releasse