PatchSiren cyber security CVE debrief

CVE-2026-41207 Netty CVE debrief

The Netty-Incubator-Codec-Ohttp, a Java language binary HTTP parser, has a vulnerability in its HKDF (Keyed-Hash Message Authentication Code) key material generation. Prior to version 0.0.21.Final, the HKDF_expand function returns a non-NULL value on failure, which is a byte array filled with zeros. This makes it impossible to distinguish between a successful and failed operation. The output of this function is used as key material for the response AEAD (Authenticated Encryption with Associated Data). Consequently, a failure in HKDF_expand silently results in an all-zero key. Furthermore, when EVP_HPKE_CTX_export fails, it also returns an empty byte array filled with zeros. This empty byte array is directly used in OHttpCrypto.createResponseAEAD(...). A silent all-zero export secret would produce a deterministic, attacker-predictable AEAD key.