CVE-2026-48480

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48480

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48480.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48480

Aliases

GHSA-r6fj-869h-4f6q

Published

2026-06-04T17:39:40.252Z

Modified

2026-08-07T20:53:18.996599Z

Severity

6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

Details

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48480.json",
    "cwe_ids": [
        "CWE-325"
    ]
}

References

Affected packages

Git / github.com/netty/netty-incubator-codec-ohttp

Affected ranges

Type

GIT

Repo

https://github.com/netty/netty-incubator-codec-ohttp

Events

Introduced

Fixed

28f977f293591a4e837bd59ceb441f9f70349915

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.0.22.Final"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

netty-incubator-codec-parent-ohttp-0.*

netty-incubator-codec-parent-ohttp-0.0.1.Final

netty-incubator-codec-parent-ohttp-0.0.10.Final

netty-incubator-codec-parent-ohttp-0.0.11.Final

netty-incubator-codec-parent-ohttp-0.0.12.Final

netty-incubator-codec-parent-ohttp-0.0.13.Final

netty-incubator-codec-parent-ohttp-0.0.14.Final

netty-incubator-codec-parent-ohttp-0.0.15.Final

netty-incubator-codec-parent-ohttp-0.0.16.Final

netty-incubator-codec-parent-ohttp-0.0.17.Final

netty-incubator-codec-parent-ohttp-0.0.18.Final

netty-incubator-codec-parent-ohttp-0.0.19.Final

netty-incubator-codec-parent-ohttp-0.0.2.Final

netty-incubator-codec-parent-ohttp-0.0.20.Final

netty-incubator-codec-parent-ohttp-0.0.21.Final

netty-incubator-codec-parent-ohttp-0.0.3.Final

netty-incubator-codec-parent-ohttp-0.0.4.Final

netty-incubator-codec-parent-ohttp-0.0.5.Final

netty-incubator-codec-parent-ohttp-0.0.6.Final

netty-incubator-codec-parent-ohttp-0.0.7.Final

netty-incubator-codec-parent-ohttp-0.0.8.Final

netty-incubator-codec-parent-ohttp-0.0.9.Final

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 464.0,
            "function_hash": "172681838440195430634242530865912492645"
        },
        "id": "CVE-2026-48480-700c1754",
        "signature_type": "Function",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915",
        "target": {
            "function": "parse",
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpVersionChunkDraft.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "210970647024931410295177236523325314805",
                "23405354356339476106513518735652854393",
                "35710410833280869337835572940126990288",
                "242233450382520168894499736045170195602",
                "86176128295672250722764126806932849931",
                "4145526744158864901075540952181738546",
                "266150131871301343082520767145242889303",
                "105738737139289637700806823227011844728",
                "200474647892198709255883345894815353391",
                "221642661635392621042063434185764719187",
                "46036457682425418680547798461795119723"
            ]
        },
        "id": "CVE-2026-48480-86c8936a",
        "signature_type": "Line",
        "source": "https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915",
        "target": {
            "file": "codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpVersionChunkDraft.java"
        }
    }
]

vanir_signatures_modified

"2026-08-07T20:53:18Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48480.json"