GHSA-vmr9-j6wf-pmh2: Maven/io.netty.incubator:netty-incubator-codec-ohttp vulnerability
The netty-incubator-codec-ohttp library implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct (native off-heap) ByteBuf to hold the decrypted plaintext before the AEAD tag is verified. If the AEAD tag check fails — meaning the ciphertext is invalid — the decryption method throws a CryptoException, but the allocated buffer is never released because no try/finally block guards the allocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty.incubator:netty-incubator-codec-ohttpto a version that resolves this vulnerability.Fixed in 0.0.23.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OHTTP gateway deployments using netty-incubator-codec-ohttp are exposed when they process encrypted client requests. The affected path allocates pooled direct native memory for decrypted plaintext.
What must occur for the memory leak to be triggered?
The gateway must receive ciphertext with an invalid AEAD authentication tag. When tag verification fails, decryption throws a CryptoException after allocating the buffer, and that buffer is not released.