CVE-2026-48040

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48040

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48040.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48040

Aliases

GHSA-32hf-8jw3-v4qq

Published

2026-06-04T17:33:55.212Z

Modified

2026-08-12T16:25:26.353909Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

Details

The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations versions prior to 0.0.22.Final provide a fallback path for direct ByteBufs that do not expose their memory address through hasMemoryAddress(). This fallback occurs when sun.misc.Unsafe is unavailable to Netty — for example, when the JVM is started with -Dio.netty.noUnsafe=true, when a SecurityManager restricts Unsafe access, or when running on non-HotSpot JVMs. In these configurations, Netty's default PooledByteBufAllocator returns PooledDirectByteBuf instances for which hasMemoryAddress() returns false. Under the enabling JVM configuration, an unauthenticated network attacker can cause the OHTTP gateway to corrupt memory belonging to other concurrent connections and disclose the contents of adjacent pooled direct buffers by triggering cryptographic operations with crafted OHTTP requests. The corruption occurs regardless of whether the AEAD tag verification succeeds, as BoringSSL zeroizes the output buffer on failure. The information disclosure path provides the attacker with the encryption key needed to extract the leaked data. This violates the confidentiality and integrity of all connections sharing the same Netty buffer arena. Version 0.0.22.Final fixes the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48040.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-787"
    ]
}

References

Affected packages

Git / github.com/netty/netty-incubator-codec-ohttp

Affected ranges

Type

GIT

Repo

https://github.com/netty/netty-incubator-codec-ohttp

Events

Introduced

Fixed

b7476c33786e8d1aab58edd54f9220901c47b3f0

Fixed

7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9

Database specific

Show details

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:netty:netty-incubator-codec-ohttp:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.0.22"
        }
    ]
}

Affected versions

netty-incubator-codec-parent-ohttp-0.*

netty-incubator-codec-parent-ohttp-0.0.1.Final

netty-incubator-codec-parent-ohttp-0.0.10.Final

netty-incubator-codec-parent-ohttp-0.0.11.Final

netty-incubator-codec-parent-ohttp-0.0.12.Final

netty-incubator-codec-parent-ohttp-0.0.13.Final

netty-incubator-codec-parent-ohttp-0.0.14.Final

netty-incubator-codec-parent-ohttp-0.0.15.Final

netty-incubator-codec-parent-ohttp-0.0.16.Final

netty-incubator-codec-parent-ohttp-0.0.17.Final

netty-incubator-codec-parent-ohttp-0.0.18.Final

netty-incubator-codec-parent-ohttp-0.0.19.Final

netty-incubator-codec-parent-ohttp-0.0.2.Final

netty-incubator-codec-parent-ohttp-0.0.20.Final

netty-incubator-codec-parent-ohttp-0.0.21.Final

netty-incubator-codec-parent-ohttp-0.0.3.Final

netty-incubator-codec-parent-ohttp-0.0.4.Final

netty-incubator-codec-parent-ohttp-0.0.5.Final

netty-incubator-codec-parent-ohttp-0.0.6.Final

netty-incubator-codec-parent-ohttp-0.0.7.Final

netty-incubator-codec-parent-ohttp-0.0.8.Final

netty-incubator-codec-parent-ohttp-0.0.9.Final

Database specific

vanir_signatures_modified

"2026-08-12T16:25:26Z"

vanir_signatures

[
    {
        "digest": {
            "function_hash": "322001499145831349188094976792516711218",
            "length": 164.0
        },
        "signature_type": "Function",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9",
        "id": "CVE-2026-48040-22931ca5",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java",
            "function": "memory_address"
        }
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "292761432537397759192114036582100413302",
                "142811826165859545199948388042119990428",
                "289867415123044179904002287032999320485",
                "100178170272513621150284836977285483454",
                "152235797205100715525646453500739641057",
                "199541117249242044596468277779812117213",
                "226664648533232024610684066135245548337",
                "97972544615218869489565960232459723131",
                "166366514651190640775910263078350875187",
                "278292175043573074845906478620864147140",
                "311412951865209016430661797309193948437",
                "186203968072570122538770282501851209122"
            ]
        },
        "signature_type": "Line",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9",
        "id": "CVE-2026-48040-2f03ee34",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java"
        }
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "146278401429666473851040613704866554754",
                "44276879003661454561614599050044801225",
                "72531387683926457352418460624249537799",
                "328071317679626639906006822072634909217",
                "17657010834808893287253322277966768879",
                "209711672455609914628178628956003237689",
                "84063656010128927801401103799123636768",
                "29702651860568442772338895900318364297"
            ]
        },
        "signature_type": "Line",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9",
        "id": "CVE-2026-48040-31aee00e",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLCryptoOperation.java"
        }
    },
    {
        "digest": {
            "function_hash": "270338807453919516458864322884938949937",
            "length": 1015.0
        },
        "signature_type": "Function",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9",
        "id": "CVE-2026-48040-67dbe47c",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLCryptoOperation.java",
            "function": "execute"
        }
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "260967176464875062691317142912269174774",
                "287452233002474368816719261814706315183",
                "300207670316999977952503845323536476699",
                "105876516597285612916381541224460771288"
            ]
        },
        "signature_type": "Line",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9",
        "id": "CVE-2026-48040-a3aafc9a",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAEADContext.java"
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48040.json"