---
id: CVE-2026-48480
title: >-
  OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected
  Stream Truncation
summary: >-
  OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected
  Stream Truncation
severity: medium
cwe:
  - CWE-325
vendor: netty
product: 'io.netty.incubator:netty-incubator-codec-ohttp'
ecosystem: maven
affected:
  - 'io.netty.incubator:netty-incubator-codec-ohttp < 0.0.22.Final'
patched:
  - 'io.netty.incubator:netty-incubator-codec-ohttp 0.0.22.Final'
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-r6fj-869h-4f6q'
references:
  - url: >-
      https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-r6fj-869h-4f6q
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48480'
  - url: >-
      https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915
  - url: 'https://github.com/advisories/GHSA-r6fj-869h-4f6q'
tags:
  - ghsa
  - maven
epss: 0.00268
epssPercentile: 0.16815
ingestedAt: '2026-06-26T16:43:14.607Z'
---

## Overview

The codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application.

## Affected packages

- `io.netty.incubator:netty-incubator-codec-ohttp < 0.0.22.Final`

## Remediation

Upgrade to a patched release:

- `io.netty.incubator:netty-incubator-codec-ohttp 0.0.22.Final`