CVE-2026-48480: Netty OHTTP undetected stream truncation in OHttpVersionChunkDraft

CVE-2026-48480 · Severity: medium · CVSS 4 · Published 2026-06-04

A vulnerability in the Netty OHTTP (Oblivious HTTP) incubator library allows an attacker positioned between a client and a server to silently truncate data streams. Because the software fails to verify that a cryptographically signed 'final' chunk was received, an attacker can cut off a message early without triggering any security errors. This could lead to incomplete data being processed as if it were a full, valid request or response, potentially compromising the integrity of communications.

Technologies: io.netty.incubator:netty-incubator-codec-ohttp (Maven), Netty Project Incubator Codec OHTTP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-48480 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48480 being exploited in the wild.
How severe is CVE-2026-48480?
Medium severity, with a CVSS score of 4, published 4 June 2026.
Which products and versions are affected?
io.netty.incubator:netty-incubator-codec-ohttp (Maven) < 0.0.22.Final, ECOSYSTEM:introduced=0,fixed=0.0.22.Final.
Is there a fix for CVE-2026-48480?
Yes. io.netty.incubator:netty-incubator-codec-ohttp (Maven): upgrade to 0.0.22.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48480 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48480?
Check whether you run io.netty.incubator:netty-incubator-codec-ohttp (Maven) or Netty Project Incubator Codec OHTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty.incubator:netty-incubator-codec-ohttp (Maven): upgrade to 0.0.22.Final or later
    # set io.netty.incubator:netty-incubator-codec-ohttp to 0.0.22.Final in your pom.xml or build.gradle

Technical details

The codec-ohttp implementation of the chunked-OHTTP draft (draft-ietf-ohai-chunked-ohttp) lacks validation for the final-chunk flag before the outer HTTP body terminates. An on-path adversary, such as an OHTTP relay or a Man-in-the-Middle (MITM), can forward only a prefix of a legitimate message and close the connection at a non-final chunk boundary. Because the receiver does not verify the cryptographic end-of-stream marker, the application processes the truncated data as complete without raising a decryption error or exception. This is classified as a Missing Cryptographic Step (CWE-325) and is resolved in version 0.0.22.Final.

Affected products

  • Netty Project netty-incubator-codec-ohttp < 0.0.22.Final

Identifiers

  • CVE-2026-48480
  • GHSA-r6fj-869h-4f6q

Timeline

  • 2026-06-03: advisory: Initial GitHub advisory published
  • 2026-06-04: disclosed: NVD publication date
  • 2026-06-23: other: Advisory updated and reviewed on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.