GitHub Advisoryadvisory · Maven

GHSA-f659-372h-6x3x netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

MEDIUM Published 2026-05-26 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-41207
Ecosystem
Maven
Packages
io.netty.incubator:netty-incubator-codec-ohttp
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-330
Reviewed
2026-05-26

Affected packages

• Maven io.netty.incubator:netty-incubator-codec-ohttp: < 0.0.21.Final → fixed in 0.0.21.Final

Description

HKDF_expand: returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key.

Related

Alias · CVE (1)

  • CVE-2026-41207 The netty incubator codec.bhttp is a java language binary http parser. vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References