The Netty Incubator OHTTP Codec allocates a pooled direct ByteBuf for plaintext before verifying the AEAD tag. When decryption fails with an invalid tag, the exception route does not free the allocated buffer, causing a native memory leak. This flaw is a form of improper memory management (CWE‑664) that can accumulate out‑of‑memory conditions on the gateway. The primary consequence is a denial of service; no confidential data is disclosed or modified, and the attacker cannot execute code or gain privileged access.

Products affected are the netty‑incubator‑codec‑ohttp modules from both the io.netty.incubator and netty vendor groups. All releases prior to 0.0.23.Final are vulnerable, while 0.0.23.Final and later contain the fix.

The CVSS score is 8.7, placing the issue in the high severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the denial‑of‑service nature means that any user able to send repeated invalid encrypted requests—most likely over the network—can exhaust the gateway's off‑heap memory. The attack vector is inferred to be remote, given that the gateway processes network traffic.