Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key. Version 0.0.21.Final patches the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-41207 Cryptographic Key Generation Failure in Netty Incubator Codec.bhttp Before http://0.0.21.Final https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41207
Post summary
A new CVE-2026-41207 has been disclosed for Netty Incubator Codec.bhttp, affecting versions prior to 0.0.21.Final. The vulnerability involves a cryptographic key generation failure.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | netty | netty-incubator-codec-ohttp | - | - | - |