CVE-2026-54251: Maven/io.netty.incubator:netty-incubator-codec-ohttp vulnerability
The netty-incubator-codec-ohttp library implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct (native off-heap) ByteBuf to hold the decrypted plaintext before the AEAD tag is verified. If the AEAD tag check fails — meaning the ciphertext is invalid — the decryption method throws a CryptoException, but the allocated buffer is never released because no try/finally block guards the allocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty.incubator:netty-incubator-codec-ohttpto a version that resolves this vulnerability.Fixed in 0.0.23.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the library's OHTTP gateway functionality are exposed when they process encrypted client requests. Client-only use is not described as affected.
What does an attacker need to send to trigger the leak?
The attacker needs to cause the gateway to process ciphertext with an invalid AEAD authentication tag. When tag verification fails, decryption throws a CryptoException after allocating a pooled direct ByteBuf that is not released.