CVE-2026-48480

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.

• CWE-325

• https://github.com/netty/netty-incubator-codec-ohttp/commit/28f977f293591a4e837bd59ceb441f9f70349915
• https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-r6fj-869h-4f6q

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48448Adobe Campaign Classic (ACC) is affected by an Improper Neut…8.6
• CVE-2026-48449Adobe Campaign Classic (ACC) is affected by an Incorrect Aut…10
• CVE-2026-4845A flaw has been found in dameng100 muucmf 1.9.5.20260309. Im…4.3
• CVE-2026-4846A vulnerability has been found in dameng100 muucmf 1.9.5.202…4.3
• CVE-2026-4847A vulnerability was found in dameng100 muucmf 1.9.5.20260309…4.3
• CVE-2026-4848A vulnerability was determined in dameng100 muucmf 1.9.5.202…4.3
• CVE-2026-48483TypeBot is a chatbot builder tool. Prior to version 3.17.0, …5.4
• CVE-2026-48485Quest Bot is an opensource Discord Bot. Prior to version 1.1…2.1
• CVE-2026-48487Zeroconf is a pure Python implementation of multicast DNS se…5.3
• CVE-2026-48488phpMyFAQ is an open source FAQ web application. Prior to ver…2.7
• CVE-2026-48489Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-4849A vulnerability was identified in code-projects Simple Laund…6.1