CVE-2017-12632: Apache NiFi host header poisoning issue
Summary
CVE-2017-12632: Apache NiFi host header poisoning issue. Affects org.apache.nifi:nifi versions >= 1.0.0, < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration and workflow automation tool that enables the automation of data flow between different systems. It provides a web-based interface for designing, controlling, and monitoring data flows. The vulnerability identified as CVE-2017-12632 affects the Apache NiFi package and can lead to host header poisoning.
Vulnerability Detail
The vulnerability arises when a malicious host header is included in an incoming HTTP request. This can trick NiFi into loading resources from an external server, potentially leading to unauthorized access or the execution of arbitrary code. The issue was addressed in the Apache NiFi 1.5.0 release by implementing measures to sanitize host headers and compare them against a controlled whitelist. Users running a prior 1.x release are advised to upgrade to the appropriate release to mitigate this vulnerability.
How To Fix
Latest published version: 2.12.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache NiFi package is vulnerable to host header poisoning, which can lead to unauthorized access or the execution of arbitrary code. Users should upgrade their Apache NiFi installation to version 1.5.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi →
FAQ
Apache NiFi is an open-source data integration and workflow automation tool that facilitates the automation of data flow between different systems.
Host header poisoning is a vulnerability that occurs when a malicious user manipulates the host header in an HTTP request to trick the server into loading resources from an external server.
This vulnerability can lead to unauthorized access or the execution of arbitrary code, depending on the attacker's intentions and the server's configuration.
The vulnerability was addressed in the Apache NiFi 1.5.0 release by implementing measures to sanitize host headers and compare them against a controlled whitelist.
To upgrade your Apache NiFi installation, follow the upgrade instructions provided by the Apache NiFi project. Ensure that the upgrade process is properly tested in a non-production environment before applying it to production systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi.
