Maven/io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl CVE-2026-48040: critical 9.1, EPSS 0.17%
netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access
Action: Upgrade io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl to 0.0.22.Final or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.22.Final | - |
Fixed versions
| 0.0.22.Final |
Sources
- osv: GHSA-32hf-8jw3-v4qq
- nvd: CVE-2026-48040
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-32hf-8jw3-v4qq
- https://github.com/netty/netty-incubator-codec-ohttp/commit/7ad38d5cc2827af7e067e5c1e1ac37cd4566dad9
- https://github.com/netty/netty-incubator-codec-ohttp
CVE-2026-48040 · published · modified · JSON