CVE-2025-66524

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-66524
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-66524.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-66524
Aliases
Downstream
Published
2025-12-19T09:24:40.687Z
Modified
2026-07-11T03:54:48.117496859Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L/U:Green CVSS Calculator
Summary
Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor
Details

Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.

Database specific 
{
    "cwe_ids": [
        "CWE-502"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.20.0"
                },
                {
                    "last_affected": "2.6.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "1.20.0"
                },
                {
                    "fixed": "2.6.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66524.json"
}
References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type
GIT
Repo
https://github.com/apache/nifi
Events
Introduced
81296b5b69a69d26afb8f8dec3a58a8363653890
Fixed
46e83d2aea47dd4285a667f7fdb93b40bb1198c3
Introduced
40173ca81468e8e2a9d913f75403bc3dbfa6b275
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.20.0"
        },
        {
            "fixed": "2.7.0"
        },
        {
            "introduced": "2.7.0-rc1"
        },
        {
            "last_affected": "2.7.0-rc1"
        },
        {
            "introduced": "2.7.0-rc2"
        },
        {
            "last_affected": "2.7.0-rc2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:nifi:2.7.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:nifi:2.7.0:rc2:*:*:*:*:*:*"
    ]
}

Affected versions

2.*
2.7.0-rc1
2.7.0-rc2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-66524.json"