netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

The netty-incubator-codec-ohttp library implements Oblivious HTTP OHTTP gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct native off-heap ByteBuf to hold the decrypted plaintext before...

GHSA-VMR9-J6WF-PMH2 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

The netty-incubator-codec-ohttp library implements Oblivious HTTP OHTTP gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct native off-heap ByteBuf to hold the decrypted plaintext before...

PT-2026-80787

BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - ID: BHTTP-LOOP-001 - Severity: High - CVSS v3.1: 7.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CWE: CWE-835 Loop with Unreachable Exit Condition — secondary CWE-400 Uncontrolled Resource...

PT-2026-80318

The netty-incubator-codec-ohttp library implements Oblivious HTTP OHTTP gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct native off-heap ByteBuf to hold the decrypted plaintext before...

PT-2026-80754

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.21.final) potentially affected by CVE-2026-48040 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.21.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.21.final Source cves: CVE-2026-48040 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-17276323...

CVE-2026-48480

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversar...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.21.final) potentially affected by CVE-2026-48040 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.21.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.21.final Source cves: CVE-2026-48040 Source advisory: MEND:CVE-2026-48040...

CVE-2026-41207 netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDFexpand returns non-NULL on failure. The byte is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a...

Netty-Incubator-Codec-ohttp security vulnerability

netty-incubator-codec-ohttp is an application developed by the Netty community. Versions prior to 0.0.22.Final of netty-incubator-codec-ohttp contain security vulnerabilities. These vulnerabilities stem from the codec-ohttp implementation, which does not verify whether a final block with a...

CVE-2026-48480: Missing Cryptographic Step

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversar...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.19.final) potentially affected by CVE-2026-41207 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.19.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.19.final Source cves: CVE-2026-41207 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-17263833...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.19.final), io.netty.incubator:netty-incubator-codec-ohttp-hpke-bouncycastle (>=0.0.3.final, <=0.0.19.final) +2 more potentially affected by CVE-2026-41207 via io.netty.incubator:netty-incubator-codec-ohttp-hpke (>=0.0.1.final, <=0.0.19.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke MAVEN version =0.0.1.final, =0.0.1.final, =0.0.3.final, =0.0.3.final, =0.0.3.final, =0.0.19.final Source cves: CVE-2026-41207 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-17263840...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: MEND:CVE-2024-40642...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: OSV:GHSA-Q8F2-HXQ5-CP4H...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: GHSA-Q8F2-HXQ5-CP4H...

Sensitive Information Disclosure

netty-incubator-codec-ohttp is vulnerable to Sensitive Information Disclosure. The vulnerability due to an error in the BoringSSLAEADContext which results the encryption nonce overflowing. An attacker can manipulate the nonce repetition by causing the sequence number to overflow, which decreases...

CVE-2024-36121

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which...

PT-2024-26908

Name of the Vulnerable Software and Affected Versions netty-incubator-codec-ohttp affected versions not specified Description The issue arises from two separate errors in BoringSSLAEADContext, which keeps track of the number of OHTTP responses sent to calculate the nonce for the encryption...

CVE-2024-36121: Exposure of Sensitive Information to an Unauthorized Actor

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which...