HIGH 8.1 GitHub
CVE-2026-61798
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
## Summary
`io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes in string representations and error messages. `BoringSSLAsymmetricCipherKeyPair.toString()` includes the private-key parameter object, and `BoringSSLAsymmetricKeyParameter.toString()` renders the full byte array with `Arrays.toString(bytes)`. Separately, failed native key initialization includes `Arrays.toString(privateKeyBytes)` in the thrown `IllegalArgumentException` message.
Affected Products
- maven/io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl <= 0.0.22.Final
References
- https://github.com/advisories/GHSA-2mc4-j865-9q4r
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-2mc4-j865-9q
- https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-pa
- https://github.com/advisories/GHSA-2mc4-j865-9q4r
This high severity vulnerability with a CVSS score of 8.1 was published on 2026-08-20 via GitHub. Affected: maven/io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl <= 0.0.22.Final.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.