What is CVE-2024-36121?

CVE-2024-36121 is a medium-severity vulnerability in Netty Netty-incubator-codec-ohttp, classified under Integer Overflow or Wraparound. CVSS score: 5.9/10. Published 2024-06-04.

How severe is CVE-2024-36121?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Integer overflow in Netty Netty-incubator-codec-ohttp

CVE-2024-36121

netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption alg…

Vulnerability class: Integer Overflow

EPSS: 0.003 (18.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N.

Affected products

Netty Netty-incubator-codec-ohttp — versions >= 0.0.3.Final, < 0.0.11.Final

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-36121?: CVE-2024-36121 is a medium-severity vulnerability in Netty Netty-incubator-codec-ohttp, classified under Integer Overflow or Wraparound. CVSS score: 5.9/10. Published 2024-06-04.
How severe is CVE-2024-36121?: Medium severity. CVSS v3 base score is 5.9 out of 10.