netty netty-incubator-codec-ohttp 0.0.21.Final missing cryptographic step

Summaryinfo

A vulnerability identified as problematic has been detected in netty netty-incubator-codec-ohttp. This issue affects some unknown processing. The manipulation leads to missing cryptographic step. This vulnerability is referenced as CVE-2026-48480. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in netty netty-incubator-codec-ohttp. It has been rated as problematic. This issue affects some unknown functionality. The manipulation with an unknown input leads to a missing cryptographic step vulnerability. Using CWE to declare the problem leads to CWE-325. The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. Impacted is integrity. The summary by CVE is:

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-48480 since 05/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 0.0.22.Final eliminates this vulnerability. Applying the patch 28f977f293591a4e837bd59ceb441f9f70349915 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• netty

Name

• netty-incubator-codec-ohttp

Version

• 0.0.21.Final

License

• open-source

Website

• Product: https://github.com/netty/netty-incubator-codec-ohttp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion