{"vulnerability": "cve-2026-48480", "sightings": [{"uuid": "bb017b2c-f7ca-4159-a957-e661d3cc045e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48480", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnic4kb5ip2y", "content": "CVE-2026-48480 - netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation\nCVE ID : CVE-2026-48480\n \n Published : June 4, 2026, 5:39 p.m. | 53\u00a0minutes ago\n \n Description : The netty incubator codec.bhttp is a jav...", "creation_timestamp": "2026-06-04T18:50:36.560942Z"}, {"uuid": "34ce8e50-5964-4ce8-a26b-bfe41c2baefa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48480", "type": "seen", "source": "https://gist.github.com/alon710/ce3b2aa80a723c8da0f2d02f44d2e2db", "content": "# CVE-2026-48480: CVE-2026-48480: Undetected Stream Truncation in netty-incubator-codec-ohttp\n\n> **CVSS Score:** 6.6\n> **Published:** 2026-06-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48480\n\n## Summary\nThe Netty incubator codec for Oblivious HTTP (OHTTP) fails to verify that a cryptographically signed final chunk is received before the outer HTTP body terminates. This missing validation allows an on-path adversary to truncate chunked-OHTTP messages cleanly at a non-final chunk boundary, leading to undetected data truncation and compromising message integrity. The vulnerability affects multiple versions of the maven package io.netty.incubator:netty-incubator-codec-ohttp prior to 0.0.22.Final.\n\n## TL;DR\nAn on-path adversary can cleanly truncate a chunked-OHTTP stream at a non-final chunk boundary, bypassing integrity checks without triggering decryption errors or application exceptions.\n\n## Technical Details\n\n- **CWE ID**: CWE-325\n- **Vulnerability Type**: Missing Cryptographic Step\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0**: 6.6 (Medium)\n- **EPSS Score**: 0.00167\n- **Exploit Status**: PoC / Test-Only\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- io.netty.incubator:netty-incubator-codec-ohttp\n- **netty-incubator-codec-ohttp**: < 0.0.22.Final (Fixed in: `0.0.22.Final`)\n\n## Mitigation\n\n- Upgrade netty-incubator-codec-ohttp to version 0.0.22.Final or higher.\n- Implement log monitoring for CorruptedFrameException indicating OHTTP stream truncation.\n- Enforce strict validation of message lengths at the application layer where possible.\n\n**Remediation Steps:**\n1. Identify all Maven dependencies referencing io.netty.incubator:netty-incubator-codec-ohttp.\n2. Update the dependency version in pom.xml to 0.0.22.Final.\n3. Rebuild and redeploy the affected applications.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48480) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-24T06:42:05.000000Z"}]}