Executive brief
A vulnerability exists in a specialized Netty library used for Oblivious HTTP (OHTTP) communications. Under certain server configurations, an unauthenticated attacker can send specially crafted network requests to corrupt memory or steal sensitive data from other users' connections. This could lead to service crashes or the exposure of private encryption keys and customer data.
Technical details
The netty-incubator-codec-ohttp library incorrectly derives native memory addresses when using BoringSSL's HPKE C library via JNI. The flaw exists in the fallback path for 'PooledDirectByteBuf' instances that do not expose their memory address via 'hasMemoryAddress()', which occurs when 'sun.misc.Unsafe' is restricted or unavailable (e.g., non-HotSpot JVMs or specific security manager settings). An attacker can trigger out-of-bounds reads or writes by sending crafted OHTTP requests. This can lead to the disclosure of adjacent buffer contents, including encryption keys, or memory corruption that persists even if AEAD tag verification fails. The issue is fixed in version 0.0.22.Final by correctly accounting for buffer positions during JNI memory access.
Affected products
- Netty netty-incubator-codec-ohttp-hpke-native-boringssl < 0.0.22.Final
Timeline
- 2026-06-03: disclosed: Initial disclosure and commit fix
- 2026-06-04: advisory: NVD publication
- 2026-06-11: advisory: GitHub Advisory published/reviewed