CVE-2017-15703: Denial of Service via Deserialization Attack in Apache NIFI
Summary
CVE-2017-15703: Denial of service via deserialization attack in nifi. Affects org.apache.nifi:nifi-framework-cluster-protocol versions < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NIFI is an open-source data integration and distribution system that enables the automation of data flow between different systems. It provides a web-based user interface for designing and managing data flows. The 'org.apache.nifi:nifi-framework-cluster-protocol' package is a component of Apache NIFI that handles cluster communication and coordination. This package is vulnerable to a denial of service attack through deserialization using JAXB.
Vulnerability Detail
The vulnerability (CVE-2017-15703) allows an attacker to perform XML External Entity (XXE) attacks by exploiting the deserialization process in Apache NIFI. By sending specially crafted XML data, an attacker can trigger the parsing of external entities, leading to various security issues such as information disclosure, server-side request forgery, and denial of service. This vulnerability has a CVSS score of 5.0 (Moderate severity).
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Apache NIFI to a secure version.
Conclusion
The vulnerability (CVE-2017-15703) in Apache NIFI allows for a denial of service attack through deserialization using JAXB. It is crucial to upgrade Apache NIFI to version 1.5.0 or later to mitigate this vulnerability. No known workarounds exist. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-framework-cluster-protocol →
FAQ
Apache NIFI is an open-source data integration and distribution system that automates the flow of data between different systems.
The 'org.apache.nifi:nifi-framework-cluster-protocol' package is a component of Apache NIFI that handles cluster communication and coordination.
A deserialization attack is a type of security vulnerability where an attacker exploits the deserialization process of an application to execute arbitrary code or perform unauthorized actions.
An XML External Entity (XXE) attack is a type of attack where an attacker can exploit the processing of XML entities to disclose internal files, perform server-side request forgery, or cause denial of service.
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
