CVE-2026-41207

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41207
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41207.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41207
Aliases
Published
2026-06-04T17:22:35Z
Modified
2026-08-12T16:25:10Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures
Details

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key. Version 0.0.21.Final patches the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-330"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41207.json"
}
References

Affected packages

Git / github.com/netty/netty-incubator-codec-ohttp

Affected ranges

Type
GIT
Repo
https://github.com/netty/netty-incubator-codec-ohttp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1e13447342d7d8174fb2c6b015d7db7e822fd531
Fixed
3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.0.21"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

netty-incubator-codec-parent-ohttp-0.*
netty-incubator-codec-parent-ohttp-0.0.1.Final
netty-incubator-codec-parent-ohttp-0.0.10.Final
netty-incubator-codec-parent-ohttp-0.0.11.Final
netty-incubator-codec-parent-ohttp-0.0.12.Final
netty-incubator-codec-parent-ohttp-0.0.13.Final
netty-incubator-codec-parent-ohttp-0.0.14.Final
netty-incubator-codec-parent-ohttp-0.0.15.Final
netty-incubator-codec-parent-ohttp-0.0.16.Final
netty-incubator-codec-parent-ohttp-0.0.17.Final
netty-incubator-codec-parent-ohttp-0.0.18.Final
netty-incubator-codec-parent-ohttp-0.0.19.Final
netty-incubator-codec-parent-ohttp-0.0.2.Final
netty-incubator-codec-parent-ohttp-0.0.20.Final
netty-incubator-codec-parent-ohttp-0.0.3.Final
netty-incubator-codec-parent-ohttp-0.0.4.Final
netty-incubator-codec-parent-ohttp-0.0.5.Final
netty-incubator-codec-parent-ohttp-0.0.6.Final
netty-incubator-codec-parent-ohttp-0.0.7.Final
netty-incubator-codec-parent-ohttp-0.0.8.Final
netty-incubator-codec-parent-ohttp-0.0.9.Final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41207.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "76268238818519181396489667128966458697",
                "56707272453347697474935054577201800543",
                "157792870596792836626000113880286005601",
                "325079273990252442732512035641779322716",
                "76268238818519181396489667128966458697",
                "56707272453347697474935054577201800543",
                "157792870596792836626000113880286005601",
                "147431040608568422618277646122209721133"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-018b6bc3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-native-boringssl/src/main/c/netty_incubator_codec_ohttp_hpke_boringssl.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "260523649219347515688030174444519990731",
                "262999924574615068609257668616284685016",
                "10741318576551579452514071896315361811",
                "113943878131517008772012445502091534990",
                "28512647330888300427652760415800930970",
                "33046681154031753044307632610848157842",
                "119262238372590382871764205777531872453",
                "220295268350282723698558356195937782124",
                "77213242812283108894974740351002347187",
                "295312821185349578023758016842843704334",
                "296792670548361982121431596527290919680",
                "120936534987060530451970988235089429177",
                "78783338346110224920129490839351923700",
                "274219394795463920096386372561041265575",
                "122575775926146532216295320335216322480"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-09fe5fc9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLHPKEContext.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "58309202981467933104345481220741155916",
            "length": 961
        },
        "id": "CVE-2026-41207-219d5496",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-native-boringssl/src/main/c/netty_incubator_codec_ohttp_hpke_boringssl.c",
            "function": "netty_incubator_codec_ohttp_hpke_boringssl_EVP_HPKE_CTX_export"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "302768876941463522710797036083558854491",
                "36788650146667737491990298471344921249",
                "27162789701810094451698870753444392166",
                "205295145727275386328807413242358944501",
                "192574729908519706420755601626178463066",
                "264459189675989002758814905963647677224",
                "273358320282941163873052276196716586022",
                "25293569183185254079010580562488703378"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-29f95e3a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCryptoReceiver.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "108742211302787549794390636185187393173",
            "length": 129
        },
        "id": "CVE-2026-41207-3183b3a3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLHPKEContext.java",
            "function": "export"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "14905246161769914555389797533578681393",
            "length": 85
        },
        "id": "CVE-2026-41207-4bf453ba",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpClientCodec.java",
            "function": "decodePrefix"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "135359162323466017870307596911834921119",
            "length": 1311
        },
        "id": "CVE-2026-41207-4d077fba",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-native-boringssl/src/main/c/netty_incubator_codec_ohttp_hpke_boringssl.c",
            "function": "netty_incubator_codec_ohttp_hpke_boringssl_HKDF_expand"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "122014477633929233924468713702638028227",
            "length": 668
        },
        "id": "CVE-2026-41207-57f3f024",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCrypto.java",
            "function": "createResponseAEAD"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "135268474841076911271605692124998057499",
            "length": 127
        },
        "id": "CVE-2026-41207-599de3a8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLHPKEContext.java",
            "function": "expand"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "198497152149298730100497430304541864329",
                "162985395648784494913655045450255352970",
                "265627347390842616484637398132490840703"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-5c5c75b3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke/src/main/java/io/netty/incubator/codec/hpke/HPKEContext.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "14277728930059405881190460601147587645",
            "length": 109
        },
        "id": "CVE-2026-41207-7b6fea3b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-bouncycastle/src/main/java/io/netty/incubator/codec/hpke/bouncycastle/BouncyCastleHPKEContext.java",
            "function": "export"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "144467848903247658758021445212554614547",
            "length": 355
        },
        "id": "CVE-2026-41207-7cfdca2f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCryptoSender.java",
            "function": "readResponseNonce"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "293233693040457974214299605143545635620",
                "315925400125903403880983370378305367228",
                "139794642288632249766722972980187549045",
                "299486479859480099952985551149926011321"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-8bdb62d4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCrypto.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "89770105944879964735227592200838843872",
                "36430370888779228072713178177348252156",
                "139775039433499573660859399885888981216",
                "337822994993676303578394998860342743111",
                "61694337465821252632063166644914258549",
                "143355824796451236660567251202255611031",
                "61874443192965715447993736684156896348",
                "308685607667250291659610686674304420884"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-8d8098ea",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCryptoSender.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "14277728930059405881190460601147587645",
            "length": 109
        },
        "id": "CVE-2026-41207-b9d8f7ea",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-bouncycastle/src/main/java/io/netty/incubator/codec/hpke/bouncycastle/BouncyCastleHPKEContext.java",
            "function": "extract"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "183722467502012968877382744969153213051",
                "331788388454430196325032898844041286981",
                "43991702014970699746341270967519525449",
                "305692493524122458975348681714529525208"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-bb20f624",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpClientCodec.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "277363262444741313241497565375063247644",
            "length": 131
        },
        "id": "CVE-2026-41207-e42dc86a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-bouncycastle/src/main/java/io/netty/incubator/codec/hpke/bouncycastle/BouncyCastleHPKEContext.java",
            "function": "expand"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "191604943394562836595206633824155104869",
            "length": 905
        },
        "id": "CVE-2026-41207-e9db0dd8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCryptoReceiver.java",
            "function": "OHttpCryptoReceiver"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "118581824169461571099017057419131069619",
                "110987698324187470174811204080579869760",
                "216700113712260383101723520887905652900",
                "276745516955758504246637214747937426837",
                "219816902329497576776347315404279269030",
                "71391460139504312754577654075406038598",
                "147637746668393889787463310294989230182",
                "173287104932987304599666498464434486024",
                "303738210083235949387696899270971438132",
                "224695834737222357843275619145284087272",
                "637610242267985092096009305221321860",
                "124194102507058480527886551282339320072",
                "250596344366143062002983776940462357865",
                "48637575505389218456739050051085345487",
                "22268330983999534348623216096456330914",
                "231459955850204013290394555127647035718",
                "313189648976076046640140043091969231237"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41207-f084b825",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-bouncycastle/src/main/java/io/netty/incubator/codec/hpke/bouncycastle/BouncyCastleHPKEContext.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281442328385478775259006558287897558385",
            "length": 105
        },
        "id": "CVE-2026-41207-f55f5959",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLHPKEContext.java",
            "function": "extract"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:10Z"