Maven/io.netty.incubator:netty-incubator-codec-ohttp CVE-2026-41207: medium 5.3, EPSS 0.19%
netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures
Action: Upgrade io.netty.incubator:netty-incubator-codec-ohttp to 0.0.21.Final or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.0.21.Final | - |
Fixed versions
| 0.0.21.Final |
Sources
- osv: GHSA-f659-372h-6x3x
- nvd: CVE-2026-41207
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-f659-372h-6x3x
- https://github.com/netty/netty-incubator-codec-ohttp/commit/3d3b4e527fc82ad0fe3db1af951ffd0ec9a10680
- https://github.com/netty/netty-incubator-codec-ohttp
CVE-2026-41207 · published · modified · JSON