netty-incubator-codec-ohttp CVE-2026-48480

Exploitation requires the attacker to occupy an on-path network position relative to the OHTTP relay: either operating as the OHTTP relay itself (malicious or compromised relay operator) or executing a MITM attack on the relay↔gateway or relay↔client transport layer. The receiving application must use the netty-incubator-codec-ohttp library at a version prior to 0.0.22.Final and process messages conforming to draft-ietf-ohai-chunked-ohttp. Standard external internet access without relay-layer positioning is insufficient for exploitation. Exploitation is further limited by the CVSS E:U modifier, indicating no observed exploitation activity. The attacker does not need authentication credentials to the application itself (PR:N), but the relay-position prerequisite is a non-trivial structural requirement that bounds realistic exposure to supply-chain compromise of the relay, insider threats, or insufficiently secured relay transport.

The CVSS 4.0 base score is 6.6 with AV:N/AC:L/AT:N/PR:N/UI:N/VI:H, indicating network-reachable, low-complexity exploitation with high integrity impact. However, the description constrains the realistic attacker to an on-path relay position - the OHTTP relay itself, or a MITM on relay transport links - which introduces a practical exploitation barrier not fully captured by AT:N. In OHTTP architecture the relay is always an on-path component by design, which explains the AT:N scoring choice, but external network attackers without relay-layer access cannot exploit this vulnerability. The E:U CVSS exploitability modifier confirms no known active exploitation or public weaponization. There is no CISA KEV listing and no public POC. Real-world priority is moderate: the threat is most relevant to OHTTP deployments using this library where relay operator trust is a concern (malicious relay) or where relay↔gateway transport is not fully secured (MITM). The confidentiality impact is none (VC:N); the risk is message integrity - truncated requests or responses may reach application logic and be processed as complete.

An OHTTP relay operator acting maliciously, or an adversary with MITM access on the relay-to-gateway transport, intercepts a chunked OHTTP message in flight, strips trailing chunks beyond a chosen non-final boundary, and signals clean HTTP body termination to the downstream gateway. The gateway's codec-ohttp library (pre-0.0.22.Final) successfully decrypts the received prefix - producing no error - and delivers the truncated, structurally incomplete message to the application, which may process it as a valid complete request or response. No public exploit code is available at time of analysis (CVSS E:U).