CVE-2026-61798

Name of the Vulnerable Software and Affected Versions io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (affected versions not specified)

Description An information disclosure issue exists where raw HPKE private key bytes are exposed in string representations and error messages. Specifically, the BoringSSLAsymmetricCipherKeyPair.toString() function includes the private-key parameter object, and the BoringSSLAsymmetricKeyParameter.toString() function renders the full byte array. Additionally, when native key initialization fails, the EVP HPKE KEY init or throw() function includes the privateKeyBytes in the IllegalArgumentException message. Since logging frameworks often call toString() or record exception messages, sensitive private key material can be persisted in logs or telemetry, allowing an attacker with log access to recover the keys and compromise the confidentiality and integrity of OHTTP messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.