CVE-2026-54251

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

EUVD-2026-78879

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251: Improper Control of a Resource Through its Lifetime

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: MEND:CVE-2026-61799...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61827 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61827 Source advisory: MEND:CVE-2026-61827...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63124 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63124 Source advisory: MEND:CVE-2026-63124...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63202 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63202 Source advisory: MEND:CVE-2026-63202...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.22.final) potentially affected by CVE-2026-61798 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.22.final Source cves: CVE-2026-61798 Source advisory: MEND:CVE-2026-61798...

CVE-2026-61799

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:08+00:00| published-proof-of-concept| https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-pgrf-4654-3gq8...

CVE-2026-63202

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:03+00:00| published-proof-of-concept| https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-4899-mpch-38p3...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63202 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63202 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428722...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2024-40642 +1 more via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2024-40642, CVE-2026-63202 Source advisory: GHSA-4899-MPCH-38P3...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2024-40642 +1 more via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2024-40642, CVE-2026-63202 Source advisory: OSV:GHSA-4899-MPCH-38P3...

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - ID: BHTTP-LOOP-001 - Severity: High - CVSS v3.1: 7.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CWE: CWE-835 Loop with Unreachable Exit Condition — secondary CWE-400 Uncontrolled Resource...

GHSA-4899-MPCH-38P3 netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - ID: BHTTP-LOOP-001 - Severity: High - CVSS v3.1: 7.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CWE: CWE-835 Loop with Unreachable Exit Condition — secondary CWE-400 Uncontrolled Resource...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61827 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61827 Source advisory: GHSA-HMQ9-67W8-J5PW...

GHSA-HMQ9-67W8-J5PW netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...