Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the decodeChunk method of the io.netty.incubator.codec.ohttp.OHttpRequestResponseContext class. The description states that when AEAD tag verification fails during the decryption of an OHTTP request, a CryptoException is thrown, but an allocated ByteBuf is not released. The commit ba6871bcbd6b3606872d2a81fabc73b284418bf8 directly addresses this by wrapping the call to decryptChunk within a try/finally block. In the vulnerable version, an exception would bypass the buffer release logic. The patch ensures that decryptedChunk.release() is called in the finally block if an exception occurs, thus plugging the memory leak. An attacker could exploit this by sending a stream of requests with invalid ciphertext, causing the gateway to continuously allocate and leak memory, leading to a denial of service.
io.netty.incubator.codec.ohttp.OHttpRequestResponseContext.decodeChunkcodec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty.incubator:netty-incubator-codec-ohttp | maven | < 0.0.23.Final | 0.0.23.Final |