Critical severity · published Jun 4, 2024
CVE-2024-36121
netty-incubator-codec-ohttp is the OHTTP implementation for netty
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netty-incubator-codec-ohttp · Netty
0.0.3 before 0.0.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36121
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36121
Product
https://github.com/netty/netty-incubator-codec-ohttp/blob/1ddadb6473cd3be5491d114431ed4c1a9f316001/codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAEADContext.java#L112-L114
Exploit
https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-g762-h86w-8749
More from Netty-incubator-codec-ohttp
9.1
CVE-2026-48040
netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access
8.7
CVE-2026-54251
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
8.1
CVE-2024-40642
The netty incubator codec.bhttp is a java language binary http parser
6.6
CVE-2026-48480
netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation
5.3
CVE-2026-41207
netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures