PT-2026-43441 · Maven+2 · Io.Netty.Incubator:Netty-Incubator-Codec-Ohttp+1

Norman Maurer + 1 · CVE-2026-41207 · Published 2026-05-26 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions netty incubator codec.bhttp versions prior to 0.0.21.Final

Description The HKDF expand() function returns a non-NULL byte array filled with zeros upon failure, making it impossible to distinguish between a successful operation and a failure. This output serves as key material for the response AEAD (Authenticated Encryption with Associated Data), meaning a failure results in an all-zero key. Similarly, when EVP HPKE CTX export fails, it returns an empty byte array filled with zeros, which is passed to the createResponseAEAD() function in OHttpCrypto. This behavior allows for the creation of a deterministic and predictable AEAD key.

Recommendations Update to version 0.0.21.Final.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2026-41207

GHSA-F659-372H-6X3X

Affected Products

Io.Netty.Incubator:Netty-Incubator-Codec-Ohttp

Netty-Incubator-Codec-Ohttp

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41207.json · Exploit
• https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-f659-372h-6x3x · Vendor Advisory
• https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41207 · Security Note
• https://osv.dev/vulnerability/GHSA-f659-372h-6x3x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41207 · Vendor Advisory
• https://github.com/netty/netty-incubator-codec-ohttp · Note
• https://t.me/CVEtracker/55871 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2062712293956133020 · Twitter Post