Is there a public PoC exploit available for CVE-2026-48480?

Yes, a public proof-of-concept exploit is available for CVE-2026-48480. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-48480?

Yes, a patch is available for CVE-2026-48480. Update the affected software to the latest version immediately.

netty-incubator-codec-ohttp CVE-2026-48480

Q: What is the CVSS score of CVE-2026-48480?

CVE-2026-48480 has a CVSS 4.0 base score of 6.6 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34311 MEDIUM

Missing Cryptographic Step (CWE-325)

2026-06-04 GitHub_M

GHSA-r6fj-869h-4f6q

Information Disclosure Java

6.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.6 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 04, 2026 - 20:01 EUVD

Source Code Evidence Fetched

Jun 04, 2026 - 19:26 vuln.today

Analysis Generated

Jun 04, 2026 - 19:26 vuln.today

CVSS changed

Jun 04, 2026 - 19:22 NVD

6.6 (MEDIUM)

DescriptionGitHub Advisory

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message-cut at a non-final chunk boundary-and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.

AnalysisAI

Truncation of chunked Oblivious HTTP (OHTTP) streams in netty-incubator-codec-ohttp prior to 0.0.22.Final silently passes partial, cryptographically-incomplete messages to the receiving application with no decryption error or exception. An on-path adversary - the OHTTP relay itself or a MITM on the relay↔gateway or relay↔client transport - can cut a legitimate chunked-OHTTP message at any non-final chunk boundary and cleanly close the outer HTTP body, bypassing the cryptographic integrity guarantee the final-chunk marker is designed to provide. No public exploit is identified (CVSS E:U) and no CISA KEV listing exists, but the integrity impact is rated High (VI:H) given that receivers silently accept and may act on structurally incomplete messages.

Technical ContextAI

The affected component is OHttpVersionChunkDraft.java in the codec-ohttp module of the Netty incubator project (CPE: cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:*), a Java library implementing draft-ietf-ohai-chunked-ohttp - the chunked variant of Oblivious HTTP. OHTTP uses HPKE (Hybrid Public Key Encryption) to encrypt message chunks, where the protocol assigns a cryptographic 'final' marker to the last chunk to signal message completeness. CWE-325 (Missing Required Cryptographic Step) precisely describes the root cause: the parse() method in OHttpVersionChunkDraft.java never checked the isFinal flag on received chunks before returning, meaning the cryptographic termination signal was computed but never validated. The fix (commit 28f977f) introduces a boolean finalChunk flag, sets it when chunkInfo.isFinal is true during parsing, and throws a CorruptedFrameException if completeBodyReceived is true but finalChunk remains false - enforcing the missing cryptographic step.

RemediationAI

Upgrade to netty-incubator-codec-ohttp version 0.0.22.Final, which is the vendor-released patch confirmed by GitHub Security Advisory GHSA-r6fj-869h-4f6q. The fix is implemented in commit 28f977f293591a4e837bd59ceb441f9f70349915 (https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915). If upgrading immediately is not feasible, implement application-layer completeness checks that validate received OHTTP message structure before downstream processing - specifically verifying that messages are not unexpectedly truncated relative to their declared content. As a network-layer compensating control, enforce mutually-authenticated TLS on all relay↔gateway and relay↔client transport links to reduce MITM opportunities; this does not fix the missing check but raises the bar for on-path interception. Auditing and restricting relay operator trust is also advisable in high-assurance OHTTP deployments, as the relay itself is a valid threat actor for this vulnerability.