CVE-2026-41207: Netty incubator-codec-ohttp predictable cryptographic key on failure

CVE-2026-41207 · Severity: medium · CVSS 4 · Published 2026-06-04

A security flaw was found in a Netty library used for processing encrypted HTTP messages. When certain cryptographic operations fail, the system incorrectly continues using a default 'all-zero' key instead of stopping with an error. This allows an attacker to predict the encryption keys used for responses, potentially allowing them to decrypt or tamper with secure communications.

Technologies: io.netty.incubator:netty-incubator-codec-ohttp (Maven), Netty Project Incubator Codec OHTTP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-41207 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41207 being exploited in the wild.
How severe is CVE-2026-41207?
Medium severity, with a CVSS score of 4, published 4 June 2026.
Which products and versions are affected?
io.netty.incubator:netty-incubator-codec-ohttp (Maven) < 0.0.21.Final, ECOSYSTEM:introduced=0,fixed=0.0.21.Final.
Is there a fix for CVE-2026-41207?
Yes. io.netty.incubator:netty-incubator-codec-ohttp (Maven): upgrade to 0.0.21.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41207 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41207?
Check whether you run io.netty.incubator:netty-incubator-codec-ohttp (Maven), Netty Project Incubator Codec OHTTP or Netty Project Netty Incubator Codec OHTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty.incubator:netty-incubator-codec-ohttp (Maven): upgrade to 0.0.21.Final or later
    # set io.netty.incubator:netty-incubator-codec-ohttp to 0.0.21.Final in your pom.xml or build.gradle

Technical details

A vulnerability exists in the Netty incubator codec.bhttp (OHTTP) where HKDF_expand and EVP_HPKE_CTX_export return a non-NULL byte array filled with zeros upon failure rather than throwing an exception. This zeroed output is subsequently used as key material for the response Authenticated Encryption with Associated Data (AEAD). Because the failure is silent, the system generates a deterministic, attacker-predictable AEAD key. This issue stems from insufficient error signaling in the native HPKE implementation. The vulnerability is resolved in version 0.0.21.Final by ensuring these methods throw a CryptoException on failure.

Affected products

  • Netty Project netty-incubator-codec-ohttp < 0.0.21.Final

Identifiers

  • CVE-2026-41207
  • GHSA-f659-372h-6x3x

Timeline

  • 2026-05-06: patched: Fix committed to repository
  • 2026-05-20: advisory: GitHub Security Advisory published
  • 2026-06-04: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.