Improper Control of a Resource Through its Lifetime Affecting io.netty.incubator:netty-incubator-codec-ohttp package, versions [,0.0.23.Final)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IONETTYINCUBATOR-19428720
- published29 Aug 2026
- disclosed20 Aug 2026
- creditUnknown
Introduced: 20 Aug 2026
NewCVE-2026-54251 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade io.netty.incubator:netty-incubator-codec-ohttp to version 0.0.23.Final or higher.
Overview
Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime in the OHttpServerCodec process. An attacker can cause a native direct memory leak by sending encrypted client requests with invalid AEAD tags, leading to resource exhaustion and potential denial of service.