---
id: CVE-2026-54251
title: >-
  netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and
  client functionality using Netty
summary: >-
  netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and
  client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway
  decryption path in
  codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequest…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-664
vendor: netty
product: netty-incubator-codec-ohttp
affected:
  - netty-incubator-codec-ohttp < 0.0.23.Final
  - netty-incubator-codec-ohttp < 0.0.23.Final
patched:
  - 'io.netty.incubator:netty-incubator-codec-ohttp 0.0.23.Final'
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T18:17:22.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54251'
references:
  - url: >-
      https://github.com/netty/netty-incubator-codec-ohttp/commit/ba6871bcbd6b3606872d2a81fabc73b284418bf8
    label: security-advisories@github.com
  - url: >-
      https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final
    label: security-advisories@github.com
  - url: >-
      https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-vmr9-j6wf-pmh2
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-vmr9-j6wf-pmh2'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-15T17:36:39.782856Z'
cvssSource: cna
aliases:
  - GHSA-vmr9-j6wf-pmh2
ecosystem: maven
ingestedAt: '2026-08-20T18:59:54.630Z'
epss: 0.00507
epssPercentile: 0.40707
---

## Overview

netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54251)

Affected packages:

- `io.netty.incubator:netty-incubator-codec-ohttp < 0.0.23.Final`

Patched in:

- `io.netty.incubator:netty-incubator-codec-ohttp 0.0.23.Final`

Source: https://github.com/advisories/GHSA-vmr9-j6wf-pmh2