CVE-2026-54251highCWE-664

CVE-2026-54251: falha de alta gravidade em io.netty.incubator netty-incubator-codec-ohttp

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

Publicada em

Seguir esta CVE+ Monitorar netty-incubator-codec-ohttp+ Monitorar netty-incubator-codec-ohttp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.5%
netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
io.netty.incubator · netty-incubator-codec-ohttpnetty · netty-incubator-codec-ohttp
CVEs relacionadas — io.netty.incubator netty-incubator-codec-ohttp

No mesmo produto, das mais perigosas para as menos.

CVE-2024-40642HIGHAbsent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp EPSS 0.7%CVE-2024-36121MEDIUM netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats NoncesEPSS 0.3%CVE-2026-41207MEDIUMnetty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failuresEPSS 0.2%CVE-2026-48040MEDIUMnetty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory AccessEPSS 0.2%CVE-2026-48480MEDIUMnetty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream TruncationEPSS 0.2%