Read the docs
TI-2026-29826 Aliases CVE-2026-41207GHSA-f659-372h-6x3x

netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

Priority LOW 36CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key. Version 0.0.21.Final patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 8th percentileScored 2026-11-07
Fix Fixed netty-incubator-codec-ohttp (netty): 0.0.21.Finalio.netty.incubator:netty-incubator-codec-ohttp (Maven): 0.0.21.Final

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty-incubator-codec-ohttpbefore 0.0.21.Final0.0.21.FinalPatch availableCNA
—io.netty.incubator:netty-incubator-codec-ohttp (Maven)before 0.0.21.Final0.0.21.FinalPatch availableGHSA-f659-372h-6x3x
  • netty-incubator-codec-ohttp Vendornetty Affected before 0.0.21.Final Fixed in 0.0.21.Final Patch available CNA
  • io.netty.incubator:netty-incubator-codec-ohttp (Maven) Vendor— Affected before 0.0.21.Final Fixed in 0.0.21.Final Patch available GHSA-f659-372h-6x3x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:*before 0.0.21Vulnerablenetty
  • cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:* Versions before 0.0.21 Vulnerable ·netty

Remediation

  • Fix · CNA netty-incubator-codec-ohttp (netty) Fixed in 0.0.21.Final
  • Fix · GHSA-f659-372h-6x3x io.netty.incubator:netty-incubator-codec-ohttp (Maven) Fixed in 0.0.21.Final Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41207
  2. 2026-10-03 Alias added: GHSA-f659-372h-6x3x

References

Patch 1

Advisory 2

Other 1

  • TI-2024-23951 netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces CVSS 3.1CRITICAL 9.1
  • TI-2024-27053 Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp CVSS 3.1HIGH 8.1
  • TI-2026-35483 Out-of-bounds read in netty-incubator-codec-ohttp CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences