CyberRota Analysis
AI-GeneratedThe vulnerability affects the Netty implementation of Oblivious HTTP (OHTTP) in versions prior to 0.0.23.Final, where improper handling of decryption failures can lead to memory leaks due to unreleased ByteBuf allocations. This can result in native off-heap memory exhaustion, potentially causing the OHTTP gateway to become unresponsive under repeated invalid requests. Organizations utilizing the affected versions of Netty for OHTTP functionality should prioritize upgrading to version 0.0.23.Final to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes decryptChunk() to throw CryptoException, OHttpRequestResponseContext.decodeChunk() does not release the ByteBuf because the allocation is not guarded by try/finally. Repeated invalid encrypted requests can therefore leak native off-heap memory until the gateway is unable to continue serving requests. This issue is fixed in version 0.0.23.Final.