CVE-2026-48480

The record

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversary (the OHTTP relay itself, or any MITM on the relay↔gateway or relay↔client transport) can forward a prefix of a legitimate chunked-OHTTP message—cut at a non-final chunk boundary—and close the outer body cleanly, producing no decryption error and no exception in the receiving application. Version 0.0.22.Final fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-25250 EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic… CWE-325
• CVE-2026-76784 Multiple TP-Link Kasa smart home devices contain insufficient cryptographic protections… CWE-325
• CVE-2026-58638 Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass… CWE-325
• CVE-2026-55144 Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform… CWE-325
• CVE-2026-6458 Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results… CWE-325
• CVE-2026-49440 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-325
• GHSA-9xg4-qhm4-g43w Deno: Miller-Rabin Primality Test Allows Zero Rounds CWE-325
• CVE-2026-9266 A Missing Required Cryptographic Step vulnerability has been identified in Moxa's… CWE-325