# CVE-2026-48480: Netty OHTTP undetected stream truncation in OHttpVersionChunkDraft

Source: https://junglewise.ai/threats/cve-2026-48480-netty-ohttp-undetected-stream-truncation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-48480 · Severity: medium · CVSS 4 · Published 2026-06-04

A vulnerability in the Netty OHTTP (Oblivious HTTP) incubator library allows an attacker positioned between a client and a server to silently truncate data streams. Because the software fails to verify that a cryptographically signed 'final' chunk was received, an attacker can cut off a message early without triggering any security errors. This could lead to incomplete data being processed as if it were a full, valid request or response, potentially compromising the integrity of communications.

Technologies: [io.netty.incubator:netty-incubator-codec-ohttp (Maven)](https://junglewise.ai/threats/technologies/io-netty-incubator-netty-incubator-codec-ohttp), [Netty Project Incubator Codec OHTTP](https://junglewise.ai/threats/technologies/incubator-codec-ohttp). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-48480 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48480 being exploited in the wild.

**How severe is CVE-2026-48480?** Medium severity, with a CVSS score of 4, published 4 June 2026.

**Which products and versions are affected?** io.netty.incubator:netty-incubator-codec-ohttp (Maven) < 0.0.22.Final, ECOSYSTEM:introduced=0,fixed=0.0.22.Final.

**Is there a fix for CVE-2026-48480?** Yes. io.netty.incubator:netty-incubator-codec-ohttp (Maven): upgrade to 0.0.22.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48480 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48480?** Check whether you run io.netty.incubator:netty-incubator-codec-ohttp (Maven) or Netty Project Incubator Codec OHTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty.incubator:netty-incubator-codec-ohttp (Maven): upgrade to 0.0.22.Final or later

  ```sh
  # set io.netty.incubator:netty-incubator-codec-ohttp to 0.0.22.Final in your pom.xml or build.gradle
  ```


## Technical details

The codec-ohttp implementation of the chunked-OHTTP draft (draft-ietf-ohai-chunked-ohttp) lacks validation for the final-chunk flag before the outer HTTP body terminates. An on-path adversary, such as an OHTTP relay or a Man-in-the-Middle (MITM), can forward only a prefix of a legitimate message and close the connection at a non-final chunk boundary. Because the receiver does not verify the cryptographic end-of-stream marker, the application processes the truncated data as complete without raising a decryption error or exception. This is classified as a Missing Cryptographic Step (CWE-325) and is resolved in version 0.0.22.Final.

## Affected products

- Netty Project netty-incubator-codec-ohttp < 0.0.22.Final

## Identifiers

- CVE-2026-48480
- GHSA-r6fj-869h-4f6q

## Timeline

- 2026-06-03: advisory: Initial GitHub advisory published
- 2026-06-04: disclosed: NVD publication date
- 2026-06-23: other: Advisory updated and reviewed on GitHub

## References

- [https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-r6fj-869h-4f6q](https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-r6fj-869h-4f6q)
- [https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915](https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915)
- [https://api.github.com/repos/netty/netty-incubator-codec-ohttp/security-advisories/GHSA-r6fj-869h-4f6q](https://api.github.com/repos/netty/netty-incubator-codec-ohttp/security-advisories/GHSA-r6fj-869h-4f6q)

## Related threats

- [Netty netty-incubator-codec-ohttp memory leak in AEAD decryption](https://junglewise.ai/threats/cve-2026-54251-netty-netty-incubator-codec-ohttp-memory-leak-in-aead-decryption)
- [Netty incubator-codec-ohttp predictable cryptographic key on failure](https://junglewise.ai/threats/cve-2026-41207-netty-incubator-codec-ohttp-predictable-cryptographic-key-on)
- [BoringSSLAEADContext in Netty Repeats Nonces](https://junglewise.ai/threats/cve-2024-36121-boringsslaeadcontext-in-netty-repeats-nonces)