https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:49:11 +0000 https://cve.radiocsirt.org/vuln/bit-nifi-2025-66524 <p><strong>Affected:</strong> Bitnami: nifi</p> <p>Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.</p> <p><strong>Affected:</strong> Bitnami: nifi</p> <p>Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.</p> https://cve.radiocsirt.org/vuln/bit-nifi-2025-66524 https://cve.radiocsirt.org/vuln/cleanstart-2026-bq50387 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Package apache-nifi version 2.6.0-r3 fixes 51 vulnerabilities: CVE-2024-29371, CVE-2024-45993, CVE-2025-8671, CVE-2025-11143, CVE-2025-31344...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Package apache-nifi version 2.6.0-r3 fixes 51 vulnerabilities: CVE-2024-29371, CVE-2024-45993, CVE-2025-8671, CVE-2025-11143, CVE-2025-31344...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bq50387 https://cve.radiocsirt.org/vuln/cnvd-2026-09798 cnvd-2026-09798 https://cve.radiocsirt.org/vuln/cnvd-2026-09798 https://cve.radiocsirt.org/vuln/euvd-2026-271191 EUVD-2026-271191 https://cve.radiocsirt.org/vuln/euvd-2026-271191 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66524 <p>Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.</p> <p>Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-66524 https://cve.radiocsirt.org/vuln/ghsa-v4p2-2w39-mhrj <p><strong>Affected:</strong> Maven: org.apache.nifi:nifi-asana-processors</p> <p>Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.</p> <p><strong>Affected:</strong> Maven: org.apache.nifi:nifi-asana-processors</p> <p>Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.</p> https://cve.radiocsirt.org/vuln/ghsa-v4p2-2w39-mhrj https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2892 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Nifi ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Nifi ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2892