netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

Vulnerability

The HPKEContext operations HKDF_expand and EVP_HPKE_CTX_export in netty-incubator-codec-ohttp return a non-NULL byte[] filled with zeros upon failure, with no way to distinguish success from failure. This zero-filled array is used directly as the export secret for creating the response AEAD via OHttpCrypto.createResponseAEAD(...). Versions prior to 0.0.21.Final are affected [1][2].

Exploitation

An attacker does not require any special privileges; any condition that causes the HPKE context operation to fail—such as invalid input or a resource limitation—will result in a deterministic all-zero AEAD key. The attacker can then predict the key without any additional information, as the failure path consistently produces the same zeroed output [1][2].

Impact

A successful attack results in complete loss of confidentiality and integrity for the encrypted response. The attacker can decrypt all response data and forge arbitrary responses that will be accepted as valid. This directly undermines the security guarantees of OHTTP (Oblivious HTTP) [1][2].

Mitigation

The issue is fixed in version 0.0.21.Final. Users should upgrade to this version or later immediately. No workaround is available [1][2].