https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T08:08:45.013138+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/ghsa-2mc4-j865-9q4r GHSA-2mc4-j865-9q4r — netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages 2026-10-13T08:08:45.014548+00:00

Affected: Maven: io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl

## Summary

`io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes in string representations and error messages. `BoringSSLAsymmetricCipherKeyPair.toString()` includes the private-key parameter object, and `BoringSSLAsymmetricKeyParameter.toString()` renders the full byte array with `Arrays.toString(bytes)`. Separately, failed native key initialization includes `Arrays.toString(privateKeyBytes)` in the thrown `IllegalArgumentException` message. Applications that log key-pair objects or exceptions can persist private key material in logs.

## Details

`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java` renders private key material through `toString()`:

- `BoringSSLAsymmetricCipherKeyPair.toString()` at lines 72-78 concatenates `"privateKey=" + privateKey`. - `privateKey` is a `BoringSSLAsymmetricKeyParameter` created with `isPrivate=true` at lines 26-36.

`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java` then renders all bytes:

- `BoringSSLAsymmetricKeyParameter.toString()` at lines 70-76 returns `"bytes=" + Arrays.toString(bytes)` regardless of whether `isPrivate` is true.

A separate error path in `codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java` also exposes caller-provided private key bytes:

- `EVP_HPKE_KEY_ini…