Read the docs
TI-2026-35844 Aliases CVE-2026-48480GHSA-r6fj-869h-4f6q

netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement…

Priority LOW 34CWE-325Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 5th percentileScored 2026-11-07
Fix Fixed netty-incubator-codec-ohttp (netty): 0.0.22.Finalio.netty.incubator:netty-incubator-codec-ohttp (Maven): 0.0.22.Final

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty-incubator-codec-ohttpbefore 0.0.22.Final0.0.22.FinalPatch availableCNA
—io.netty.incubator:netty-incubator-codec-ohttp (Maven)before 0.0.22.Final0.0.22.FinalPatch availableGHSA-r6fj-869h-4f6q
  • netty-incubator-codec-ohttp Vendornetty Affected before 0.0.22.Final Fixed in 0.0.22.Final Patch available CNA
  • io.netty.incubator:netty-incubator-codec-ohttp (Maven) Vendor— Affected before 0.0.22.Final Fixed in 0.0.22.Final Patch available GHSA-r6fj-869h-4f6q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:*——netty
  • cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:* Versions — — ·netty

Remediation

  • Fix · CNA netty-incubator-codec-ohttp (netty) Fixed in 0.0.22.Final
  • Fix · GHSA-r6fj-869h-4f6q io.netty.incubator:netty-incubator-codec-ohttp (Maven) Fixed in 0.0.22.Final Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48480
  2. 2026-10-03 Alias added: GHSA-r6fj-869h-4f6q

References

Advisory 1

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
  • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences