CVE-2026-54251highCWE-664

CVE-2026-54251: fallo de gravedad alta en io.netty.incubator netty-incubator-codec-ohttp

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

Publicada el

Seguir esta CVE+ Monitorear netty-incubator-codec-ohttp+ Monitorear netty-incubator-codec-ohttp

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%
netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
io.netty.incubator · netty-incubator-codec-ohttpnetty · netty-incubator-codec-ohttp
CVEs relacionadas — io.netty.incubator netty-incubator-codec-ohttp

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-40642HIGHAbsent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp EPSS 0.7%CVE-2024-36121MEDIUM netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats NoncesEPSS 0.3%CVE-2026-41207MEDIUMnetty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failuresEPSS 0.2%CVE-2026-48040MEDIUMnetty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory AccessEPSS 0.2%CVE-2026-48480MEDIUMnetty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationEPSS 0.2%