CVE-2024-36121

MEDIUM

Netty OHTTP Codec 0.0.3-0.0.11 - Nonce Reuse via Sequence Overflow

Title source: manual

Description

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately, two separate errors combine which would allow an attacker to cause the sequence number to overflow and thus the nonce to repeat.

References (2)

Core 2

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-g762-h86w-8749

Product x_refsource_misc

https://github.com/netty/netty-incubator-codec-ohttp/blob/1ddadb6473cd3be5491d114431ed4c1a9f316001/codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAEADContext.java#L112-L114

View Writeup ZIP pw:eip

Scores

CVSS v3 5.9

EPSS 0.0027

EPSS Percentile 18.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-190 CWE-200 CWE-323

Status published

Products (2)

io.netty.incubator/netty-incubator-codec-ohttp 0.0.3.Final - 0.0.11.FinalMaven

netty/netty-incubator-codec-ohttp 0.0.3 - 0.0.11

Published Jun 04, 2024

Tracked Since Feb 18, 2026