THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-2mc4-j865-9q4r (high) — netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

[GHSA] GHSA-2mc4-j865-9q4r (high) — netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

medgithub_advisoriesPublished 2026-08-20

GHSA-2mc4-j865-9q4r Severity: high CVE: CVE-2026-61798

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

## Summary

`io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes in string representations and error messages. `BoringSSLAsymmetricCipherKeyPair.toString()` includes the private

Indicators of compromise

CVE-2026-61798cve

Original source: https://github.com/advisories/GHSA-2mc4-j865-9q4r