{"id":"CVE-2026-54251","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-54251","summary":"netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service","details":"The **netty-incubator-codec-ohttp** library implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty's `ByteBuf` memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct (native off-heap) `ByteBuf` to hold the decrypted plaintext before the AEAD tag is verified. If the AEAD tag check fails — meaning the ciphertext is invalid — the decryption method throws a `CryptoException`, but the allocated buffer is never released because no `try/finally` block guards the allocation.","published":"2026-08-20T18:39:50Z","modified":"2026-08-20T18:45:15.002973535Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"io.netty.incubator:netty-incubator-codec-ohttp","fixedVersion":"0.0.23.Final"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-vmr9-j6wf-pmh2"},{"type":"PACKAGE","url":"https://github.com/netty/netty-incubator-codec-ohttp"},{"type":"WEB","url":"https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-20T18:45:15.002973535Z"}}