6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41207

CVE-2026-41207: netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

HKDF_expand: returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key.

When EVP_HPKE_CTX_export fails it also returns an empty byte[] array filled with zeros. This byte[] feeds directly into OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41207

CVE-2026-41207:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty.incubator:netty-incubator-codec-ohttp	maven	< 0.0.21.Final	0.0.21.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from the way HPKE (Hybrid Public Key Encryption) context operations handled failures in netty-incubator-codec-ohttp. Specifically, functions like export and expand in the HPKEContext implementations (BoringSSLHPKEContext and BouncyCastleHPKEContext) would produce an empty or zero-filled byte array upon internal failure, rather than signaling an error to the caller. This behavior was particularly dangerous because the output of these functions is used as keying material for cryptographic operations.

The root cause is the lack of robust error handling between the Java code and the underlying cryptographic libraries (BoringSSL native and BouncyCastle). When a failure occurred, for instance in the native EVP_HPKE_CTX_export or HKDF_expand functions, the Java layer would receive a zeroed array but treat it as a valid secret.

The function io.netty.incubator.codec.ohttp.OHttpCrypto.createResponseAEAD directly consumed this potentially compromised secret from HPKEContext.export to derive an AEAD (Authenticated Encryption with Associated Data) key for encrypting HTTP responses. A silent failure in export would lead to a deterministic, all-zero key, allowing an attacker who can trigger such a failure to predict the encryption key and decrypt the response.

The patch addresses this by modifying the HPKEContext interface and its implementations to throw a CryptoException on failure. The native BoringSSL code was also updated to return NULL on failure, which the Java wrapper now checks for. This ensures that any failure during key derivation is properly propagated and handled, preventing the use of insecure, predictable keys.

Vulnerable functions

io.netty.incubator.codec.hpke.boringssl.BouncyCastleHPKEContext.export

codec-ohttp-hpke-bouncycastle/src/main/java/io/netty/incubator/codec/hpke/bouncycastle/BouncyCastleHPKEContext.java

The function previously returned the result of `context.export` directly. If the underlying Bouncy Castle operation failed, it could return an insecure value (like a zero-filled array) without signaling an error. The patch wraps the call in a try-catch block to throw a `CryptoException` on failure, preventing the use of the insecure value.

io.netty.incubator.codec.hpke.boringssl.BouncyCastleHPKEContext.expand

codec-ohttp-hpke-bouncycastle/src/main/java/io/netty/incubator/codec/hpke/bouncycastle/BouncyCastleHPKEContext.java

Similar to `export`, this function did not handle failures from the underlying `context.expand` call. A failure could lead to an insecure output being returned. The patch adds exception handling to ensure failures are propagated.

io.netty.incubator.codec.hpke.boringssl.BoringSSLHPKEContext.export

codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLHPKEContext.java

The function calls a native method `BoringSSL.EVP_HPKE_CTX_export`. Before the patch, it returned the result directly. The native implementation could return a zero-filled array on failure. The patch adds a null check to detect failure from the native layer and throws a `CryptoException`, preventing the use of a predictable, all-zero key.

io.netty.incubator.codec.hpke.boringssl.BoringSSLHPKEContext.expand

codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLHPKEContext.java

This function calls the native method `BoringSSL.HKDF_expand`. The vulnerability description states that `HKDF_expand` returns a non-NULL, zero-filled byte array on failure. The patch checks if the returned value is null (after the native code was changed to return null on failure) and throws an exception, thus preventing the use of an insecure key.

io.netty.incubator.codec.ohttp.OHttpCrypto.createResponseAEAD

codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpCrypto.java

This function is a key consumer of the vulnerable `HPKEContext.export` method. It takes the secret returned by `export` and uses it to create an AEAD context for encrypting responses. When `export` returned a predictable, all-zero array on failure, this function would proceed to create a weak, predictable encryption key, compromising the confidentiality of the response.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.