Read the docs
TI-2026-39153 Aliases CVE-2026-54251GHSA-vmr9-j6wf-pmh2

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD…

Priority MEDIUM 44CWE-664Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00507 43rd percentileScored 2026-11-07
Fix Fixed netty-incubator-codec-ohttp (netty): 0.0.23.Finalnetty-incubator-codec-ohttp (io.netty.incubator): 0.0.23.Final+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty-incubator-codec-ohttpbefore 0.0.23.Final0.0.23.FinalPatch availableCNA
io.netty.incubatornetty-incubator-codec-ohttpbefore 0.0.23.Final0.0.23.FinalPatch availableCNA
—io.netty.incubator:netty-incubator-codec-ohttp (Maven)before 0.0.23.Final0.0.23.FinalPatch availableGHSA-vmr9-j6wf-pmh2
  • netty-incubator-codec-ohttp Vendornetty Affected before 0.0.23.Final Fixed in 0.0.23.Final Patch available CNA
  • netty-incubator-codec-ohttp Vendorio.netty.incubator Affected before 0.0.23.Final Fixed in 0.0.23.Final Patch available CNA
  • io.netty.incubator:netty-incubator-codec-ohttp (Maven) Vendor— Affected before 0.0.23.Final Fixed in 0.0.23.Final Patch available GHSA-vmr9-j6wf-pmh2

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:*——netty
  • cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:* Versions — — ·netty

Remediation

  • Fix · CNA netty-incubator-codec-ohttp (netty) Fixed in 0.0.23.Final
  • Fix · CNA netty-incubator-codec-ohttp (io.netty.incubator) Fixed in 0.0.23.Final
  • Fix · GHSA-vmr9-j6wf-pmh2 io.netty.incubator:netty-incubator-codec-ohttp (Maven) Fixed in 0.0.23.Final Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54251
  2. 2026-10-03 Alias added: GHSA-vmr9-j6wf-pmh2

References

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
  • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences