netty-incubator-codec-ohttp CVE-2026-54251
HIGH
GHSA-vmr9-j6wf-pmh2
Severity by source
Network-accessible unauthenticated endpoint by OHTTP design; trivial to trigger; impact is availability-only (memory exhaustion DoS), no confidentiality or integrity effect confirmed.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
3DescriptionCVE.org
The netty-incubator-codec-ohttp library implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct (native off-heap) ByteBuf to hold the decrypted plaintext before the AEAD tag is verified. If the AEAD tag check fails - meaning the ciphertext is invalid - the decryption method throws a CryptoException, but the allocated buffer is never released because no try/finally block guards the allocation.
AnalysisAI
Native off-heap memory exhaustion in netty-incubator-codec-ohttp (versions before 0.0.23.Final) allows unauthenticated remote attackers to cause a gateway denial-of-service by repeatedly sending OHTTP requests with invalid ciphertext. Each request that fails AEAD tag verification causes the pre-allocated pooled direct ByteBuf to leak permanently, because the decryption path lacks a try/finally guard around the buffer release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The OHTTP gateway codec (OHttpServerCodec) must be deployed and reachable by the attacker over the network - the vulnerability is in the server-side gateway decryption path, not the client path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate-to-high for any deployment that exposes an OHTTP gateway endpoint, despite the absence of a published CVSS score from NVD. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade io.netty.incubator:netty-incubator-codec-ohttp to version 0.0.23.Final, which introduces proper try/finally buffer lifecycle management around the AEAD decryption path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate all systems running netty-incubator-codec-ohttp versions prior to 0.0.23.Final and assess whether they handle untrusted OHTTP traffic. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today