Salusasecondus

**Name of the Vulnerable Software and Affected Versions** netty-incubator-codec-ohttp (affected versions not specified) **Description** The issue arises from two separate errors in BoringSSLAEADContext, which keeps track of the number of OHTTP responses sent to calculate the nonce for the encryption algorithm. These errors can cause the sequence number to overflow, resulting in a repeated nonce. The sequence number is stored as a 32-bit int, making it relatively easy to overflow, and there is no overflow detection or enforcement of the maximum sequence value. If the BoringSSLAEADContext is used to encrypt more than 2^32 messages, the AES-GCM nonce will repeat, compromising both confidentiality and integrity of the encrypted data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.