Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty.incubator:netty-incubator-codec-ohttp | maven | < 0.0.22.Final | 0.0.22.Final |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the io.netty.incubator.codec.ohttp.OHttpVersionChunkDraft class, specifically within the parse method. The provided patch in commit 28f977f293591a4e837bd59ceb441f9f70349915 clearly shows the addition of logic to enforce the presence of a final chunk in a chunked OHTTP message when the entire body has been received. The vulnerability description states that the implementation "does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates." The patch directly addresses this by adding a boolean finalChunk flag that is updated as chunks are processed. At the end of the parse method, a new conditional check is added: if (completeBodyReceived && !finalChunk). If this condition is met, a CorruptedFrameException is thrown, preventing the silent truncation of the data stream. The absence of this check in the vulnerable versions is what allows the attack. Therefore, the parse function is the exact location of the vulnerability.
io.netty.incubator.codec.ohttp.OHttpVersionChunkDraft.parsecodec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpVersionChunkDraft.java