Read the docs
TI-2025-40945 Aliases CVE-2025-66524GHSA-v4p2-2w39-mhrj

Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor

Priority LOW 36CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00594 48th percentileScored 2026-11-07
Fix Fixed org.apache.nifi:nifi-asana-processors (Maven): 2.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache NiFi1.20.0 – 2.6.0—No fix listedCNA
—org.apache.nifi:nifi-asana-processors (Maven)1.20.0 to before 2.7.02.7.0Patch availableGHSA-v4p2-2w39-mhrj
  • Apache NiFi VendorApache Affected 1.20.0 – 2.6.0 Fixed in — No fix listed CNA
  • org.apache.nifi:nifi-asana-processors (Maven) Vendor— Affected 1.20.0 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-v4p2-2w39-mhrj

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*1.20.0 to before 2.7.0VulnerableApache
cpe:2.3:a:apache:nifi:2.7.0:rc1:*:*:*:*:*:*2.7.0 rc1VulnerableApache
cpe:2.3:a:apache:nifi:2.7.0:rc2:*:*:*:*:*:*2.7.0 rc2VulnerableApache
  • cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:* Versions 1.20.0 to before 2.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:nifi:2.7.0:rc1:*:*:*:*:*:* Versions 2.7.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:nifi:2.7.0:rc2:*:*:*:*:*:* Versions 2.7.0 rc2 Vulnerable ·Apache

Remediation

  • Fix · GHSA-v4p2-2w39-mhrj org.apache.nifi:nifi-asana-processors (Maven) Fixed in 2.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66524
  2. 2026-10-03 Alias added: GHSA-v4p2-2w39-mhrj

References

Advisory 2

Other 3

  • TI-2023-17293 Apache NiFi: Potential Code Injection with Database Services using H2 CVSS 3.1HIGH 8.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-07411 Deserialization of untrusted data in Apache Commons Beanutils CVSS 3.1HIGH 7.3
  • TI-2017-11471 Improper input validation in Apache NiFi CVSS 3.0CRITICAL 9.8
  • TI-2018-01212 XML external entity injection in Apache NiFi CVSS 3.0CRITICAL 9.8
  • TI-2021-03489 Deserialization of untrusted data in jackson-databind CVSS 3.1HIGH 8.1
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences