Executive brief
A vulnerability in the Netty OHTTP (Oblivious HTTP) incubator library allows an attacker positioned between a client and a server to silently truncate data streams. Because the software fails to verify that a cryptographically signed 'final' chunk was received, an attacker can cut off a message early without triggering any security errors. This could lead to incomplete data being processed as if it were a full, valid request or response, potentially compromising the integrity of communications.
Technical details
The codec-ohttp implementation of the chunked-OHTTP draft (draft-ietf-ohai-chunked-ohttp) lacks validation for the final-chunk flag before the outer HTTP body terminates. An on-path adversary, such as an OHTTP relay or a Man-in-the-Middle (MITM), can forward only a prefix of a legitimate message and close the connection at a non-final chunk boundary. Because the receiver does not verify the cryptographic end-of-stream marker, the application processes the truncated data as complete without raising a decryption error or exception. This is classified as a Missing Cryptographic Step (CWE-325) and is resolved in version 0.0.22.Final.
Affected products
- Netty Project netty-incubator-codec-ohttp < 0.0.22.Final
Timeline
- 2026-06-03: advisory: Initial GitHub advisory published
- 2026-06-04: disclosed: NVD publication date
- 2026-06-23: other: Advisory updated and reviewed on GitHub