OSSEVA FOR APACHE NIFI
Apache NiFi enterprise support: patched NiFi 1.x while you plan 2.0
Apache NiFi enterprise support from OSSeva keeps NiFi 1.x patched after the project stopped releasing it: 1.28.1, the last 1.x release, shipped on 19 November 2024 and 1.x reached end of life on 8 December 2024. Send your work email and an engineer replies within 1 business day with coverage for your exact 1.x version and its NARs.
| Who it is for | Platform and data teams running NiFi 1.19, 1.23, 1.26 or 1.28 flows that cannot move to NiFi 2 yet |
|---|---|
| What you get | Signed 1.x builds with CVE fixes backported and the flow definition, NARs and parameter contexts unchanged. Assure adds a processor inventory against what 2.x removed, plus 24/7 reactive support. |
| How it is priced | Per cluster, not per flow, processor or data volume. Ask for a quote. |
| What happens next | You send your work email, we confirm your version and components, and you get a coverage plan. |
Reply within 1 business day · No commitment · or book a 15-minute call
Last reviewed
Trusted globally by enterprises
NiFi end-of-life dates, checked 20 October 2026
endoflife.date ends a NiFi minor when the next one is released. That holds for 2.x as well, so NiFi 2 is a release cadence to keep up with, not a place to stop. Dates below are from endoflife.date, which tracks the NiFi download page.
| Line | End of life | Status on 20 October 2026 |
|---|---|---|
| 1.19 | 9 Feb 2023 | End of life |
| 1.23 | 27 Nov 2023 | End of life |
| 1.26 | 7 Jul 2024 | End of life |
| 1.28 (final 1.x, 1.28.1 on 19 Nov 2024) | 8 Dec 2024 | End of life |
| 2.0 | 23 Dec 2024 | End of life |
| 2.7 | 13 Feb 2026 | End of life |
| 2.11 | 13 Sep 2026 | End of life |
| 2.12 (2.12.0 on 13 Sep 2026) | Not set | Supported |
Of the thirteen 2.x minors from 2.0 to 2.12, twelve are already end of life. OSSeva patched builds cover 1.19.x, 1.23.x, 1.26.x and 1.28.x.
NiFi end-of-life chart, every version →NiFi 1.x end of life →
Advisories published since NiFi 1.x reached end of life
OSSeva's CVE directory lists 12 entries published after 8 December 2024 whose affected range includes NiFi 1.28.x. The upstream fix for each is in a 2.x release; none is on the 1.x line.
| CVE | Published | CVSS | Affected range (NVD) | Fixed upstream in |
|---|---|---|---|---|
| CVE-2024-56512 | 2024-12-28 | 5.4 | 1.10.0 to 2.0.0 | 2.1.0 |
| CVE-2025-27017 | 2025-03-12 | 6.5 | 1.13.0 to 2.2.0 | 2.3.0 |
| CVE-2025-66524 | 2025-12-19 | 8.8 | >=1.20.0 <2.7.0; 2.7.0 | See advisory |
| CVE-2026-25903 | 2026-02-17 | 6.6 | 1.1.0 to 2.7.2 | 2.8.0 |
| CVE-2026-44914 | 2026-06-22 | 7.2 | 1.12.0 to 2.9.0 | 2.10.0 |
| CVE-2026-44913 | 2026-06-22 | 7.2 | 1.2.0 to 2.9.0 | 2.10.0 |
| CVE-2026-54665 | 2026-06-22 | 5.3 | 0.0.1 to 2.9.0 | 2.10.0 |
| CVE-2026-44911 | 2026-06-22 | 6.3 | 1.15.0 to 2.9.0 | 2.10.0 |
| CVE-2026-68979 | 2026-08-03 | 9.8 | >=1.10.0 <2.11.0 | See advisory |
| CVE-2026-68981 | 2026-08-03 | 7.5 | 1.5.0 to 2.10.0 | 2.11.0 |
| CVE-2026-62354 | 2026-08-03 | 4.3 | 1.10.0 to 2.10.0 | 2.11.0 |
| CVE-2026-82561 | 2026-09-16 | 6.5 | 1.5.0 to 2.11.0 | 2.12.0 |
The directory is OSSeva's curated list from NVD, not every advisory filed. Confirm any entry at nvd.nist.gov.
NiFi 1.x to 2.0 upgrade: the sequence
The upgrade is a flow rebuild, not a version bump. Patched 1.x builds make it a project with a date instead of an emergency.
- Upgrade to NiFi 1.27.0 or later 1.x first. NiFi's migration guidance requires 1.27.0 before 2.0.0.
- Inventory every processor, controller service and reporting task on the canvas through the NiFi API (command under How it installs).
- Replace the components 2.0 removed while you are still on 1.27 or 1.28, and move the JVM to Java 21.
- Point nifi.flow.configuration.file at flow.json.gz instead of flow.xml.gz, then validate the output against real data.
Why now
The 1.x line has stopped
NiFi 1.28.1 was the end of the 1.x series. All development, all fixes and every release since have gone to 2.x. There is no 1.x maintenance branch receiving security patches, and there will not be one — which leaves every production 1.x canvas permanently exposed to anything disclosed from here on.
NiFi 2.0 removed processors that live in production flows
The 2.0 release raised the Java baseline to 21 and removed a substantial set of deprecated processors, controller services and reporting tasks. Flows built over years against those components do not import cleanly. The upgrade is a rebuild-and-revalidate exercise against real data, scheduled around whatever those flows feed.
NiFi holds credentials for everything it connects to
A NiFi instance stores database passwords, cloud keys, SFTP credentials and API tokens in its parameter contexts and controller services, and routes regulated data between them. Authentication and authorisation advisories in NiFi are not confined to NiFi — they reach every system in the canvas.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 1.19.x(1.x line ended — OSSeva patched) | EOL | Clean |
| 1.23.x(1.x line ended — OSSeva patched) | EOL | Clean |
| 1.26.x(1.x line ended — OSSeva patched) | EOL | Clean |
| 1.28.x(Final 1.x release — OSSeva patched) | EOL | Clean |
| 2.x(Upstream maintained) | Current | Clean |
Running a Apache NiFi version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE patches for NiFi 1.x with the canvas untouched.
- Security backports across the 1.x line, flows unchanged
- Authentication, authorisation and policy advisory coverage
- Bundled NAR dependency patching (Jetty, Jackson, Netty)
- Docker / tarball delivery
- Signed artifacts (GPG)
- Flow inventory and 2.x migration assessment
- 24/7 managed operations
OSSeva Assure
Patch plus a processor inventory mapped against what 2.x removed.
- Everything in Patch
- Full processor and controller service inventory
- Removed-component gap analysis against NiFi 2.x
- Parameter context and credential handling audit
- SOC 2 / HIPAA attestation package
- Costed flow migration plan to 2.x
- 24/7 reactive support
OSSeva Operate
Full MSP: 24/7 dataflow monitoring, 15-min SLA, named NiFi engineers.
- Everything in Assure
- 24/7 queue backpressure and flow throughput monitoring
- 15-minute P1 incident response SLA
- Named senior NiFi engineer
- Content and provenance repository management
- Flow migration execution to NiFi 2.x
- Quarterly dataflow and capacity reviews
All tiers priced per cluster/application — not per core.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
# Version of a running instance
curl -s -k https://nifi:8443/nifi-api/system-diagnostics \
| jq '.systemDiagnostics.aggregateSnapshot.versionInfo'
# Every processor type on the canvas — the 2.x gap analysis starts here
curl -s -k https://nifi:8443/nifi-api/process-groups/root/processors \
| jq -r '.processors[].component.type' | sort | uniq -c | sort -rn# Same flow.xml.gz, same NARs, patched dependencies
docker pull artifacts.osseva.io/nifi:1.28.1-osseva-1
docker run -d --name nifi \
-p 8443:8443 \
-v /opt/nifi/conf:/opt/nifi/nifi-current/conf \
-v /opt/nifi/state:/opt/nifi/nifi-current/state \
artifacts.osseva.io/nifi:1.28.1-osseva-1Migrate from Unsupported NiFi 1.x deployments
OSSeva patches the 1.x line in place so the existing canvas, NARs and parameter contexts keep working exactly as configured. The move to 2.x is then scoped from a real processor inventory — including which removed components need replacements built — rather than discovered halfway through a migration window.
Pricing model
OSSeva for Apache NiFi is priced per cluster — not per flow, processor or volume of data moved.
ZooKeeper 3.5 custom support for NiFi 1.10 to 1.16
Which NiFi releases bundle ZooKeeper 3.5? NiFi 1.10 through 1.15.0 ship 3.5.6, and 1.15.1 through 1.16.3 ship 3.5.9. NiFi 1.17.0 moved to ZooKeeper 3.8.0.
ZooKeeper 3.5 reached end of life on 1 June 2022, and 3.5.10 was its last release, so the Apache project issues no more fixes for it. OSSeva's standard ZooKeeper coverage starts at 3.6. ZooKeeper 3.5 is offered as custom support, scoped per engagement.
Custom support covers CVE backports into 3.5.x builds made from the upstream source, and SBOM and VEX evidence for each build. A scanner finding or an auditor's question then gets a written answer for your configuration: fixed, not present, or not reachable.
Many NiFi 1.x clusters run the embedded ZooKeeper, so the old jar sits inside the application rather than in a separate ensemble. Where moving NiFi to 1.17 or later is possible, that is the cleaner fix. Custom 3.5 support is for clusters that cannot move yet, and we scope the ZooKeeper build and the NiFi line together.
Send us the versions you run and we scope it with you. Contact us for a quote.
Releases that bundle ZooKeeper 3.5.x
| Release | Bundled ZooKeeper |
|---|---|
| NiFi 1.10.0 to 1.15.0 | 3.5.6 |
| NiFi 1.15.1 to 1.16.3 | 3.5.9 |
Source: nifi-nar-bundles/nifi-framework-bundle/pom.xml at each NiFi release tag (github.com/apache/nifi), checked 15 October 2026.
Who provides Apache NiFi enterprise support?
OSSeva provides enterprise support for Apache NiFi today, including the 1.x line upstream no longer patches. Patch ships signed 1.x builds with backported CVE fixes, covering bundled dependencies such as Jetty 9.4 and Spring Framework 5.3 that the NiFi project says cannot be upgraded on 1.x. Assure adds compliance attestation and VEX statements. Operate adds 24/7 managed operations with a 15-minute P1 response.
How do you upgrade NiFi 1.x to 2.0?
In stages. NiFi's migration guidance requires upgrading to 1.27.0 before moving to 2.0.0. NiFi 2 requires Java 21, removes the components deprecated in 1.x, and needs nifi.flow.configuration.file changed to point at flow.json.gz instead of flow.xml.gz. Replace removed processors and controller services while still on 1.27 or 1.28, then move the flow.
Is Apache NiFi 1.x still supported?
No. Apache NiFi 1.28 is the last minor release of the 1.x series, and the NiFi download page gives its end of support as 8 December 2024. The final release, 1.28.1, shipped on 19 November 2024. The project says any exceptional 1.x fix will not include dependency upgrades. The current line is 2.x, and NiFi 2.12.0 was released on 13 September 2026.
Why can't we just upgrade to NiFi 2.x?
Because 2.0 was a deliberate clean break. It raised the Java baseline to 21 and removed a large set of deprecated processors, controller services and reporting tasks. Flows built against those components do not import cleanly, so the upgrade means rebuilding parts of the canvas and revalidating the output against real data — work that has to be scheduled around whatever those flows feed.
Does patching NiFi require rebuilding our flows?
No. OSSeva ships patched builds on the 1.x line you already run, so flow.xml.gz, the NAR set, parameter contexts and controller services all stay as configured. The canvas is untouched; only the underlying binaries change.
Where do most NiFi vulnerabilities actually come from?
Two places. The first is NiFi's own authentication, authorisation and policy handling, which matters because NiFi holds credentials for every system in the canvas. The second, and more frequent, is the third-party libraries bundled inside the NARs — Jetty, Jackson, Netty and their dependencies. OSSeva patches both.
We run NiFi in a Cloudera distribution. Does that change coverage?
It changes what you are entitled to upstream, not what is running. Cloudera Flow Management packages NiFi with its own support lifecycle, and estates frequently hold versions that are behind both the Cloudera and Apache lines. OSSeva covers the NiFi binaries you actually run, Apache or Cloudera-packaged, matched to the exact version rather than the badge.
Does OSSeva support current NiFi versions or only the 1.x line?
OSSeva's support matrix lists NiFi 2.x as current and upstream maintained. OSSeva's patched builds cover the 1.19.x, 1.23.x, 1.26.x and 1.28.x lines that upstream no longer fixes, and Assure and Operate plan and run the move to 2.x. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days.
How is OSSeva Apache NiFi support priced?
OSSeva for Apache NiFi is priced per cluster, not per flow, processor or volume of data moved. Patch covers the patched builds, Assure adds the processor inventory and migration plan and 24/7 reactive support, and Operate adds proactive 24/7 monitoring with a 15-minute P1 SLA. Book a discovery call for a quote.
Get a quote
Ready to get Apache NiFi patched and supported?
Tell us your Apache NiFi versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?