netty-incubator-codec-ohttp EUVD-2026-78879

The OHTTP gateway codec (OHttpServerCodec) must be deployed and reachable by the attacker over the network - the vulnerability is in the server-side gateway decryption path, not the client path. The trigger condition is receipt of an OHTTP request whose AEAD ciphertext fails tag verification (i.e., any request with an invalid, truncated, or deliberately corrupted encrypted payload). Because OHTTP gateways are designed to accept unauthenticated anonymous traffic as part of the protocol's privacy model, no authentication or session state is required to trigger the bug. The vulnerability does not depend on any non-default configuration setting - any deployment using the OHttpServerCodec for decryption is affected. Exploitation is limited by: (1) the library being a Netty incubator project with low adoption compared to mainstream frameworks; (2) the gateway needing to be network-exposed; (3) rate limiting or WAF controls upstream of the gateway would slow but not prevent exploitation.

Real-world risk is moderate-to-high for any deployment that exposes an OHTTP gateway endpoint, despite the absence of a published CVSS score from NVD. The attack vector is network-accessible (AV:N), requires no privileges (PR:N since OHTTP gateways are designed to accept anonymous public requests), and low complexity (AC:L - sending requests with corrupted ciphertext is trivial). The denial-of-service impact is High (A:H) because native direct memory exhaustion can kill the gateway process. No EPSS score is available and this CVE is not in CISA KEV, so widespread active exploitation is not confirmed. The 'Information Disclosure' tag in the source data appears to be a misclassification: the described mechanism is a resource leak, not a data leak, and the CWE-664 classification supports DoS rather than disclosure. A potential secondary concern - that leaked buffers in a native memory pool could expose prior allocation contents under certain pool reuse scenarios - is not confirmed by the advisory and should not be treated as a confirmed confidentiality impact. The vulnerability is straightforward to exploit conceptually but is limited to environments actually running the OHTTP gateway codec, which is an incubator (pre-production) library with a niche adoption base.

An attacker targeting a publicly accessible OHTTP gateway constructs a stream of OHTTP-encapsulated requests in which the ciphertext body is deliberately corrupted so that AEAD tag verification always fails. Each such request causes the gateway to allocate a native direct ByteBuf that is never freed. With sufficient request volume - achievable with standard HTTP load tooling - native off-heap memory is exhausted, causing the gateway JVM to throw OutOfMemoryError or become unresponsive, denying service to legitimate OHTTP clients. No proof-of-concept code is known to be publicly available; however, reproducing the condition requires only the ability to send well-formed OHTTP outer envelopes with invalid inner ciphertext.