{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/netty-incubator-codec-ohttp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-incubator-codec-ohttp"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eThe netty-incubator-codec-ohttp library is susceptible to a native memory leak (CVE-2026-54251) impacting versions prior to 0.0.23.Final. This vulnerability exists within the OHTTP gateway functionality, which leverages Netty's pooled direct memory management for handling encrypted requests. When the gateway receives an OHTTP request, it allocates a native off-heap 'ByteBuf' to store decrypted plaintext prior to verifying the AEAD authentication tag. If the AEAD tag verification fails due to malformed or malicious ciphertext, a 'CryptoException' is triggered; however, the library fails to include a 'try-finally' block to release the allocated buffer. Repeatedly sending requests with invalid AEAD tags forces the application to leak native memory with every failed attempt, eventually leading to exhaustion of the Java process's off-heap memory and a service-wide denial-of-service condition.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an application-level denial-of-service. By repeatedly triggering the memory leak, an attacker can exhaust the target system's native memory, causing the JVM process to crash or become unresponsive to legitimate OHTTP traffic. This vulnerability is particularly critical for high-traffic OHTTP gateways exposed to the internet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the 'netty-incubator-codec-ohttp' dependency to version 0.0.23.Final or higher immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing deployments for high memory utilization or 'OutOfMemoryError: Direct buffer memory' exceptions correlated with AEAD decryption errors.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on OHTTP gateway endpoints to mitigate the frequency at which an attacker can trigger the vulnerable decryption path.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:13:15Z","date_published":"2026-08-20T19:13:15Z","id":"https://feed.craftedsignal.io/briefs/2026-08-netty-ohttp-leak/","summary":"The netty-incubator-codec-ohttp library suffers from a native memory leak during AEAD decryption failures, allowing unauthenticated attackers to induce a denial-of-service by exhausting off-heap memory.","title":"Native Memory Leak in netty-incubator-codec-ohttp via CVE-2026-54251","url":"https://feed.craftedsignal.io/briefs/2026-08-netty-ohttp-leak/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-incubator-codec-bhttp","netty-incubator-codec-ohttp"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","netty"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eThe \u003ccode\u003enetty-incubator-codec-bhttp\u003c/code\u003e library, used for decoding Binary HTTP (RFC 9292) messages, contains a critical control-flow defect in the \u003ccode\u003eBinaryHttpParser.readFieldSection\u003c/code\u003e method. The vulnerability arises from an improper loop termination condition (\u003ccode\u003efieldSectionLength != 0\u003c/code\u003e) and the failure to enforce forward progress when processing field lines.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated attacker can supply a malformed BHTTP request where the declared field-section length does not match the actual data. If the parser consumes zero bytes or consumes more bytes than declared, the loop enters an infinite busy-spin. Because the code relies on Java \u003ccode\u003eassert\u003c/code\u003e statements - which are stripped in production JVM environments - to guarantee termination and progress, the defect is fully exposed to remote exploitation. A small number of these requests can pin every available Netty event-loop thread at 100% CPU, resulting in a complete denial of service for OHTTP gateways or clients until the process is restarted.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains the target OHTTP gateway's public HPKE key configuration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious BHTTP message where the declared field-section length is understated relative to the actual field line contents.\u003c/li\u003e\n\u003cli\u003eAttacker wraps the malicious BHTTP payload within a standard OHTTP request, encrypted with the gateway's public key.\u003c/li\u003e\n\u003cli\u003eOHTTP gateway receives the request and decrypts the chunk into the \u003ccode\u003ebinaryHttpCumulation\u003c/code\u003e buffer.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOHttpRequestResponseContext\u003c/code\u003e passes the attacker-controlled plaintext directly to \u003ccode\u003eBinaryHttpParser.parse\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eBinaryHttpParser\u003c/code\u003e enters the \u003ccode\u003ereadFieldSection\u003c/code\u003e method and triggers the vulnerable \u003ccode\u003ewhile\u003c/code\u003e loop (lines 619-626).\u003c/li\u003e\n\u003cli\u003eThe loop fails to terminate due to the \u003ccode\u003e!= 0\u003c/code\u003e condition or zero-byte progress, initiating an infinite CPU-bound spin.\u003c/li\u003e\n\u003cli\u003eRepeating the request exhausts the Netty event-loop group, leading to a total denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe attack results in an unauthenticated, persistent denial of service. By pinning the event-loop threads of an OHTTP gateway or client, the attacker renders the service incapable of accepting new connections or processing traffic. The impact is significant for high-availability infrastructure relying on Netty-based OHTTP gateways, as the service remains unavailable until manual intervention (process restart) occurs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003enetty-incubator-codec-bhttp\u003c/code\u003e to a version containing the patched \u003ccode\u003eBinaryHttpParser\u003c/code\u003e logic that replaces the vulnerable \u003ccode\u003ewhile\u003c/code\u003e loop with explicit exception handling.\u003c/li\u003e\n\u003cli\u003ePromote input validation invariants previously handled by \u003ccode\u003eassert\u003c/code\u003e (lines 622, 624) to explicit \u003ccode\u003eCorruptedFrameException\u003c/code\u003e checks to ensure security regardless of JVM assertion settings.\u003c/li\u003e\n\u003cli\u003eVerify that production deployments are not bypassing framing errors; ensure the parser enforces strict adherence to RFC 9292 regarding declared versus actual field-section length consumption.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:12:42Z","date_published":"2026-08-20T19:12:42Z","id":"https://feed.craftedsignal.io/briefs/2026-08-netty-bhttp-dos/","summary":"An infinite loop vulnerability in the BinaryHttpParser of netty-incubator-codec-bhttp allows unauthenticated attackers to exhaust event-loop threads and induce a persistent denial of service via specially crafted BHTTP requests.","title":"Unauthenticated CPU Exhaustion DoS in netty-incubator-codec-bhttp","url":"https://feed.craftedsignal.io/briefs/2026-08-netty-bhttp-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Incubator-Codec-Ohttp","version":"https://jsonfeed.org/version/1.1"}