Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-05 | 1 | General1 |
| 2026-06-24 | 1 | Disclosure1 |
CVE-2026-48480 in netty-incubator-codec-ohttp allows on-path attackers to truncate OHTTP streams undetected by bypassing integrity checks. https://ift.tt/67pYTEo
Post summary
The post discloses CVE-2026-48480, explaining that on‑path attackers can truncate OHTTP streams by bypassing integrity checks, potentially enabling tampering without detection.
CVE-2026-48480 Unverified Cryptographic Signature in Netty Incubator Codec-OHTTP Prior to http://0.0.22.Final https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48480
Post summary
CVE-2026-48480 describes an unverified cryptographic signature issue in Netty’s Incubator Codec‑OHTTP affecting all releases before 0.0.22.Final, with a reference to a vulnerability details page for further information.