Executive brief
The netty-incubator-codec-ohttp library is used by OHTTP gateways to process encrypted client requests. When the gateway receives a tampered or invalid encrypted message, it fails to release a block of allocated native memory, allowing attackers to send crafted requests that exhaust available memory and crash the gateway service, disrupting availability for legitimate users.
Technical details
The vulnerability is a resource leak (CWE-664) in the OHttpServerCodec class during AEAD (Authenticated Encryption with Associated Data) decryption. When processing an encrypted OHTTP client request, the codec allocates a pooled direct ByteBuf to hold the decrypted plaintext before verifying the AEAD authentication tag. If the authentication tag check fails (indicating invalid or tampered ciphertext), the decryption method throws a CryptoException, but the allocated buffer is never released due to missing try/finally block guards. An attacker can trigger this leak repeatedly by sending malformed encrypted requests to a gateway over the network without authentication, causing native memory exhaustion and denial of service. The vulnerability is fixed in version 0.0.23.Final.
Affected products
- Netty netty-incubator-codec-ohttp < 0.0.23.Final
Timeline
- 2026-07-09: disclosed: Advisory published
- 2026-07-10: patched: Fix released in version 0.0.23.Final
References
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-vmr9-j6wf-pmh2
- https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final
- https://api.github.com/repos/netty/netty-incubator-codec-ohttp/security-advisories/GHSA-vmr9-j6wf-pmh2