CVE-2026-54251
Received Received - Intake

Memory Leak in Netty OHTTP Gateway Decryption

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-54251
EUVD
EUVD-2026-78879

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netty codec_ohttp to 0.0.23.Final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-664 The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in the netty-incubator-codec-ohttp library affecting versions before 0.0.23.Final. When processing encrypted requests, the OHTTP gateway allocates a direct ByteBuf for decrypted data before verifying the AEAD tag. If verification fails, the buffer is not released due to missing error handling, causing native memory leaks that can exhaust system resources.

Detection Guidance

Detecting this vulnerability requires monitoring for memory leaks in the netty-incubator-codec-ohttp library. Check for increasing direct memory usage over time using tools like jcmd <pid> VM.native_memory or monitoring JVM metrics. Look for repeated decryption failures in logs that may indicate attempts to exploit this issue.

Impact Analysis

The memory leak can lead to denial of service by exhausting system memory, causing the gateway to fail serving requests. Attackers could repeatedly send invalid encrypted requests to trigger leaks until the system crashes or becomes unresponsive.

Mitigation Strategies

Upgrade to version 0.0.23.Final or later of netty-incubator-codec-ohttp immediately. If upgrading is not possible, restrict network access to the OHTTP gateway to trusted sources only and monitor for unusual memory consumption patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart