1. Home
  2. CVE Database
  3. CVE-2024-36121
MEDIUM · 5.9

CVE-2024-36121

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropria...

Vulnerability Description

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
NettyNetty-Incubator-Codec-Ohttp>= 0.0.3, < 0.0.11

Related Weaknesses (CWE)

CWE-323CWE-190CWE-200

References

FAQ

What is CVE-2024-36121?

CVE-2024-36121 is a vulnerability with a CVSS score of 5.9 (MEDIUM). netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropria...

How severe is CVE-2024-36121?

CVE-2024-36121 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-36121?

Check the references section above for vendor advisories and patch information. Affected products include: Netty Netty-Incubator-Codec-Ohttp.