6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48040

CVE-2026-48040: netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations versions prior to 0.0.22.Final provide a fallback path for direct ByteBufs that do not expose their memory address through hasMemoryAddress(). This fallback occurs when sun.misc.Unsafe is unavailable to Netty — for example, when the JVM is started with -Dio.netty.noUnsafe=true, when a SecurityManager restricts Unsafe access, or when running on non-HotSpot JVMs. In these configurations, Netty's default PooledByteBufAllocator returns PooledDirectByteBuf instances for which hasMemoryAddress() returns false. Under the enabling JVM configuration, an unauthenticated network attacker can cause the OHTTP gateway to corrupt memory belonging to other concurrent connections and disclose the contents of adjacent pooled direct buffers by triggering cryptographic operations with crafted OHTTP requests. The corruption occurs regardless of whether the AEAD tag verification succeeds, as BoringSSL zeroizes the output buffer on failure. The information disclosure path provides the attacker with the encryption key needed to extract the leaked data. This violates the confidentiality and integrity of all connections sharing the same Netty buffer arena. Version 0.0.22.Final fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48040

CVE-2026-48040:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl	maven	< 0.0.22.Final	0.0.22.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from an incorrect calculation of native memory addresses for Netty ByteBuf objects, specifically when the JVM is configured without access to sun.misc.Unsafe. In this scenario, the library falls back to a method of deriving pointers that fails to account for buffer slicing in pooled allocators.

The root cause is the io.netty.incubator.codec.hpke.boringssl.BoringSSL.memory_address(ByteBuf) function. When a ByteBuf did not expose its memory address directly (i.e., hasMemoryAddress() returned false), this function would create a java.nio.ByteBuffer spanning the entire capacity of the underlying buffer, ignoring the specific offset and length of the ByteBuf slice. This resulted in a base pointer that was incorrect for the slice being used.

This incorrect pointer was then used in cryptographic operations within io.netty.incubator.codec.hpke.boringssl.BoringSSLCryptoOperation.execute, which takes user-provided data in ByteBufs for encryption/decryption. An attacker could send a crafted OHTTP request that triggers these operations, leading to out-of-bounds reads and writes in the native BoringSSL library. This could corrupt or disclose data from other concurrent connections sharing the same memory pool.

The patch rectifies this by removing the flawed memory_address function and introducing readerMemoryAddress and writerMemoryAddress. These new functions correctly calculate the pointer by creating a ByteBuffer view that respects the ByteBuf's specific offset (readerIndex or writerIndex) and length, ensuring all native operations occur within the intended memory boundaries.

Vulnerable functions

io.netty.incubator.codec.hpke.boringssl.BoringSSL.memory_address

codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.