Uncontrolled Resource Consumption

netty-incubator-codec-bhttp is vulnerable to Uncontrolled Resource Consumption . The vulnerability is due to improper termination and lack of forward-progress validation in the BinaryHttpParser field-section decoding loop, which allows an unauthenticated attacker to send a crafted Binary HTTP...

CVE-2026-54251

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

EUVD-2026-78879

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251: Improper Control of a Resource Through its Lifetime

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

Denial-of-service (DoS)

io.netty.incubator, netty-incubator-codec-ohttp is vulnerable to a denial-of-service DoS. The vulnerability is due to an allocated direct ByteBuf not being released when AEAD tag verification fails, which allows an attacker to repeatedly send invalid encrypted requests and exhaust native memory,...

Denial Of Service

netty-incubator-codec-ohttp is vulnerable to Denial of Service. The vulnerability is due to the BinaryHttpParser not enforcing limits for encoded variable length fields, where a remote peer controls these lengths and can cause the parser to buffer data indefinitely...

CVE-2026-61799

"io.netty.incubator:netty-incubator-codec-bhttp" uses attacker-controlled Binary HTTP variable-length integers as "long" values but accumulates them into "int" offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked "ArrayIndexOutOfBoundsException" /...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: MEND:CVE-2026-61799...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61827 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61827 Source advisory: MEND:CVE-2026-61827...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63124 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63124 Source advisory: MEND:CVE-2026-63124...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63202 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63202 Source advisory: MEND:CVE-2026-63202...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.22.final) potentially affected by CVE-2026-61798 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.22.final Source cves: CVE-2026-61798 Source advisory: MEND:CVE-2026-61798...

CVE-2026-61798

"io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl" exposes raw HPKE private key bytes in string representations and error messages. "BoringSSLAsymmetricCipherKeyPair.toString" includes the private-key parameter object, and "BoringSSLAsymmetricKeyParameter.toString" renders th...

CVE-2026-61799

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:08+00:00| published-proof-of-concept| https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-pgrf-4654-3gq8...

CVE-2026-63202

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:03+00:00| published-proof-of-concept| https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-4899-mpch-38p3...

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - ID: BHTTP-LOOP-001 - Severity: High - CVSS v3.1: 7.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CWE: CWE-835 Loop with Unreachable Exit Condition — secondary CWE-400 Uncontrolled Resource...