CVE-2026-54251

netty-incubator-codec-ohttp, a Netty library implementing Oblivious HTTP (OHTTP) gateway and client functionality, contains a native memory leak in versions prior to 0.0.23.Final. In OHttpRequestResponseContext.decodeChunk(), a pooled direct ByteBuf is allocated for the decrypted plaintext before the AEAD authentication tag is verified, and the allocation is not guarded by try/finally; when an attacker sends an encrypted request with an invalid tag, decryptChunk() throws a CryptoException and the ByteBuf is never released. By repeatedly sending malformed encrypted requests, an unauthenticated remote attacker can exhaust native off-heap memory until the OHTTP gateway can no longer serve requests, a denial-of-service condition only (no confidentiality or integrity impact, reflected in the CVSS 4.0 score of 8.7 with high availability impact). Any service embedding netty-incubator-codec-ohttp earlier than 0.0.23.Final as an OHTTP gateway is affected. The issue is fixed in 0.0.23.Final, and no public proof of concept or known in-the-wild exploitation has been reported.

What to do: Upgrade netty-incubator-codec-ohttp to 0.0.23.Final or later, which releases the ByteBuf even when tag verification fails. As defense-in-depth, monitor Netty pooled direct-memory usage (PooledByteBufAllocator metrics, Netty leak detector, or NativeMemoryTracking) and alert on clusters of CryptoException or OHTTP decryption failures, which would indicate repeated malformed-request attempts. A restart of affected gateway processes reclaims the leaked native memory as a recovery measure, and rate-limiting or rejecting malformed encrypted requests upstream can blunt the attack.