CVE-2026-41207 Details
Description
The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key. Version 0.0.21.Final patches the issue.
A vulnerability exists in the Netty Incubator Codec BHTTP library, specifically in versions prior to 0.0.21.Final. The issue arises because the HKDF_expand function and the EVP_HPKE_CTX_export function both return empty byte arrays filled with zeros on failure, without indicating that an error occurred. This all-zero output is used as key material for the response AEAD (Authenticated Encryption with Associated Data). As a result, a failure in these operations can lead to the creation of a predictable AEAD key, which could be exploited by an attacker.
Users can upgrade to Netty Incubator Codec BHTTP version 0.0.21.Final or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-330 | Use of Insufficiently Random Values | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty-incubator-codec-ohttp | < 0.0.21 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 4, 2026 | New CVE Received | [email protected] |