CVE-2026-54251

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54251
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54251.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54251
Aliases
Published
2026-09-15T17:13:13Z
Modified
2026-09-17T03:47:12Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
Details

netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-664"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54251.json"
}
References

Affected packages

Git / github.com/netty/netty-incubator-codec-ohttp

Affected ranges

Type
GIT
Repo
https://github.com/netty/netty-incubator-codec-ohttp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ba6871bcbd6b3606872d2a81fabc73b284418bf8
Fixed
6d6b46a3af14d993e98ccaa60bf5a67660a4eac8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.0.23.Final"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

netty-incubator-codec-parent-ohttp-0.*
netty-incubator-codec-parent-ohttp-0.0.1.Final
netty-incubator-codec-parent-ohttp-0.0.10.Final
netty-incubator-codec-parent-ohttp-0.0.11.Final
netty-incubator-codec-parent-ohttp-0.0.12.Final
netty-incubator-codec-parent-ohttp-0.0.13.Final
netty-incubator-codec-parent-ohttp-0.0.14.Final
netty-incubator-codec-parent-ohttp-0.0.15.Final
netty-incubator-codec-parent-ohttp-0.0.16.Final
netty-incubator-codec-parent-ohttp-0.0.17.Final
netty-incubator-codec-parent-ohttp-0.0.18.Final
netty-incubator-codec-parent-ohttp-0.0.19.Final
netty-incubator-codec-parent-ohttp-0.0.2.Final
netty-incubator-codec-parent-ohttp-0.0.20.Final
netty-incubator-codec-parent-ohttp-0.0.21.Final
netty-incubator-codec-parent-ohttp-0.0.22.Final
netty-incubator-codec-parent-ohttp-0.0.3.Final
netty-incubator-codec-parent-ohttp-0.0.4.Final
netty-incubator-codec-parent-ohttp-0.0.5.Final
netty-incubator-codec-parent-ohttp-0.0.6.Final
netty-incubator-codec-parent-ohttp-0.0.7.Final
netty-incubator-codec-parent-ohttp-0.0.8.Final
netty-incubator-codec-parent-ohttp-0.0.9.Final

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54251.json"