io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl 0.0.20.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Out-of-bounds Read Affected versions of this package are vulnerable to Out-of-bounds Read in the fallback process for deriving native memory addresses when `hasMemoryAddress()` returns false and `sun.misc.Unsafe` is unavailable. An attacker can corrupt memory of concurrent connections and disclose contents of adjacent pooled direct buffers by sending crafted OHTTP requests. Note: This is only exploitable if the JVM is configured to disable Unsafe access (e.g., with `-Dio.netty.noUnsafe=true`), a SecurityManager restricts Unsafe access, or when running on non-HotSpot JVMs. How to fix Out-of-bounds Read? Upgrade `io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` to version 0.0.22.Final or higher.	[,0.0.22.Final)
M Insecure Randomness Affected versions of this package are vulnerable to Insecure Randomness due to the `HKDF_expand` and `EVP_HPKE_CTX_export` functions returning a zero-filled byte array on failure, which is then used as key material for AEAD encryption. An attacker can predict and exploit the deterministic, all-zero AEAD key by triggering failures in these cryptographic operations. How to fix Insecure Randomness? Upgrade `io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` to version 0.0.21.Final or higher.	[,0.0.21.Final)

Vulnerability

Vulnerable Version

Out-of-bounds Read

Affected versions of this package are vulnerable to Out-of-bounds Read in the fallback process for deriving native memory addresses when hasMemoryAddress() returns false and sun.misc.Unsafe is unavailable. An attacker can corrupt memory of concurrent connections and disclose contents of adjacent pooled direct buffers by sending crafted OHTTP requests.

Note:

This is only exploitable if the JVM is configured to disable Unsafe access (e.g., with -Dio.netty.noUnsafe=true), a SecurityManager restricts Unsafe access, or when running on non-HotSpot JVMs.

How to fix Out-of-bounds Read?

Upgrade io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl to version 0.0.22.Final or higher.

[,0.0.22.Final)

Insecure Randomness

Affected versions of this package are vulnerable to Insecure Randomness due to the HKDF_expand and EVP_HPKE_CTX_export functions returning a zero-filled byte array on failure, which is then used as key material for AEAD encryption. An attacker can predict and exploit the deterministic, all-zero AEAD key by triggering failures in these cryptographic operations.

How to fix Insecure Randomness?

Upgrade io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl to version 0.0.21.Final or higher.

[,0.0.21.Final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl@0.0.20.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically