CVE-2026-48480
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The codec-ohttp implementation in netty incubator codec.bhttp prior to version 0.0.22.Final does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path attacker can truncate the message and close the body without causing a decryption error.
Risk Assessment
The risk is that the integrity of OHTTP messages can be bypassed, potentially leading to unauthorized disclosure or modification of data transmitted through the relay.
Recommendation
Update netty-incubator-codec-bhttp to version 0.0.22.Final or later, which includes a fix.
Other vulnerabilities in netty-incubator-codec-bhttp
Original NVD description (English source)
The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS