PT-2026-46309 · Netty · Netty Incubator Codec.Bhttp

Normanmaurer · Published 2026-06-04 · Updated 2026-06-05 · CVE-2026-48040

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions netty incubator codec.bhttp versions prior to 0.0.22.Final

Description The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When sun.misc.Unsafe is unavailable—such as when the JVM is started with -Dio.netty.noUnsafe=true, when a SecurityManager restricts access, or on non-HotSpot JVMs—a fallback path is provided for direct ByteBufs that do not expose their memory address through hasMemoryAddress(). In these configurations, an unauthenticated network attacker can trigger cryptographic operations with crafted OHTTP requests to corrupt memory belonging to other concurrent connections and disclose the contents of adjacent pooled direct buffers. This occurs regardless of whether the AEAD (Authenticated Encryption with Associated Data) tag verification succeeds, as BoringSSL zeroizes the output buffer on failure. The information disclosure provides the encryption key required to extract the leaked data, compromising the confidentiality and integrity of all connections sharing the same Netty buffer arena.

Recommendations Update to version 0.0.22.Final.

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

CVE-2026-48040

Affected Products

Netty Incubator Codec.Bhttp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-48040 · Security Note
• https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-32hf-8jw3-v4qq · Note
• https://github.com/netty/netty-incubator-codec-ohttp/commit/7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9 · Note
• https://twitter.com/VulmonFeeds/status/2062709733979496567 · Twitter Post