netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

TRUNG BÌNH 5.3CVE-2026-41207 · GHSA-f659-372h-6x3x · Công bố 04/06/2026 · cập nhật 22/07/2026

Tóm tắt nhanh

CVE-2026-41207 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng io.netty.incubator:netty-incubator-codec-ohttp, netty-incubator-codec-ohttp (netty).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.19%, cao hơn 9.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.0.21.Final, 0.0.21 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
io.netty.incubator:netty-incubator-codec-ohttp Maven	`< 0.0.21.Final`	`0.0.21.Final`
netty-incubator-codec-ohttp netty	`< 0.0.21`	`0.0.21`

Mô tả

HKDF_expand: returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key.

When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key.

Mô tả của NVD

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key. Version 0.0.21.Final patches the issue.