Vulnerability Description
The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key. Version 0.0.21.Final patches the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netty | Netty-Incubator-Codec-Ohttp | < 0.0.21 |
Related Weaknesses (CWE)
References
- https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3dPatch
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-f6Vendor Advisory
FAQ
What is CVE-2026-41207?
CVE-2026-41207 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to disting...
How severe is CVE-2026-41207?
CVE-2026-41207 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41207?
Check the references section above for vendor advisories and patch information. Affected products include: Netty Netty-Incubator-Codec-Ohttp.