io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.21.final) potentially affected by CVE-2026-48040 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.21.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.21.final Source cves: CVE-2026-48040 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-17276323...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.21.final) potentially affected by CVE-2026-48040 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.21.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.21.final Source cves: CVE-2026-48040 Source advisory: MEND:CVE-2026-48040...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.19.final), io.netty.incubator:netty-incubator-codec-ohttp-hpke-bouncycastle (>=0.0.3.final, <=0.0.19.final) +2 more potentially affected by CVE-2026-41207 via io.netty.incubator:netty-incubator-codec-ohttp-hpke (>=0.0.1.final, <=0.0.19.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke MAVEN version =0.0.1.final, =0.0.1.final, =0.0.3.final, =0.0.3.final, =0.0.3.final, =0.0.19.final Source cves: CVE-2026-41207 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-17263840...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.19.final) potentially affected by CVE-2026-41207 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.19.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.19.final Source cves: CVE-2026-41207 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-17263833...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: MEND:CVE-2024-40642...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: OSV:GHSA-Q8F2-HXQ5-CP4H...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: GHSA-Q8F2-HXQ5-CP4H...

Sensitive Information Disclosure

netty-incubator-codec-ohttp is vulnerable to Sensitive Information Disclosure. The vulnerability due to an error in the BoringSSLAEADContext which results the encryption nonce overflowing. An attacker can manipulate the nonce repetition by causing the sequence number to overflow, which decreases...

CVE-2024-36121

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which...

PT-2024-26908

Name of the Vulnerable Software and Affected Versions netty-incubator-codec-ohttp affected versions not specified Description The issue arises from two separate errors in BoringSSLAEADContext, which keeps track of the number of OHTTP responses sent to calculate the nonce for the encryption...

CVE-2024-36121: Exposure of Sensitive Information to an Unauthorized Actor

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which...