{"id":"CVE-2026-48480","title":"OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation","summary":"OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation","severity":"medium","cwe":["CWE-325"],"vendor":"netty","product":"io.netty.incubator:netty-incubator-codec-ohttp","ecosystem":"maven","affected":["io.netty.incubator:netty-incubator-codec-ohttp < 0.0.22.Final"],"patched":["io.netty.incubator:netty-incubator-codec-ohttp 0.0.22.Final"],"published":"2026-06-23","updated":"2026-06-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-r6fj-869h-4f6q","references":[{"url":"https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-r6fj-869h-4f6q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48480"},{"url":"https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915"},{"url":"https://github.com/advisories/GHSA-r6fj-869h-4f6q"}],"tags":["ghsa","maven"],"epss":0.00167,"epssPercentile":0.0638,"ingestedAt":"2026-06-26T16:43:14.607Z","slug":"CVE-2026-48480","body":"## Overview\n\nThe codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application.\n\n## Affected packages\n\n- `io.netty.incubator:netty-incubator-codec-ohttp < 0.0.22.Final`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `io.netty.incubator:netty-incubator-codec-ohttp 0.0.22.Final`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}