CVE-2026-48480: netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
The codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty.incubator:netty-incubator-codec-ohttpto a version that resolves this vulnerability.Fixed in 0.0.22.Final - Upgrade
Upgrade
netty-incubator-codec-ohttpto a version that resolves this vulnerability.Fixed in 0.0.22.FinalPatch netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48480?
The severity of CVE-2026-48480 is medium with a score of 6.6.
How do I fix CVE-2026-48480?
To fix CVE-2026-48480, upgrade to version 0.0.22.Final or later of netty-incubator-codec-ohttp.
What impact does CVE-2026-48480 have on my application?
CVE-2026-48480 can lead to undetected stream truncation due to missing enforcement of the final chunk in chunked HTTP responses.
Who is affected by CVE-2026-48480?
Applications using versions prior to 0.0.22.Final of netty-incubator-codec-ohttp are affected by CVE-2026-48480.
What type of attack can exploit CVE-2026-48480?
CVE-2026-48480 can be exploited by an on-path adversary to manipulate or truncate HTTP streams.