Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Norman Maurer

#45368of 60,590
6.9Total CVSS
Vulnerabilities · 1
PT-2026-43441
2026-05-26
6.9
CVE-2026-41207
Unknown
Netty Incubator Codec.Bhttp
The `HKDF expand()` function returns a non-NULL byte array filled with zeros upon failure, making it impossible to distinguish between a successful operation and a failure. This output serves as key material for the response AEAD (Authenticated Encryption with Associated Data), meaning a failure results in an all-zero key. Similarly, when `EVP HPKE CTX export` fails, it returns an empty byte array filled with zeros, which is passed to the `createResponseAEAD()` function in `OHttpCrypto`. This behavior allows for the creation of a deterministic and predictable AEAD key.