CVE-2026-61798: Infoleak
Summary
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString() includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString() renders the full byte array with Arrays.toString(bytes). Separately, failed native key initialization includes Arrays.toString(privateKeyBytes) in the thrown IllegalArgumentException message. Applications that log key-pair objects or exceptions can persist private key material in logs.
Details
codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java renders private key material through toString():
- BoringSSLAsymmetricCipherKeyPair.toString() at lines 72-78 concatenates "privateKey=" + privateKey. - privateKey is a BoringSSLAsymmetricKeyParameter created with isPrivate=true at lines 26-36.
codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java then renders all bytes:
- BoringSSLAsymmetricKeyParameter.toString() at lines 70-76 returns "bytes=" + Arrays.toString(bytes) regardless of whether isPrivate is true.
A separate error path in codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java also exposes caller-provided private key bytes:
- EVPHPKEKEYinitorthrow(...) at lines 228-232 throws IllegalArgumentException("privateKeyBytes does not contain a valid private key: " + Arrays.toString(privateKeyBytes)) when BoringSSL rejects the key.
Because Java logging frameworks commonly call toString() for structured objects and commonly persist exception messages, these paths can place complete HPKE private key material in logs or telemetry.
Proof of concept
Safe local verification was performed without native BoringSSL by compiling the relevant Java classes and a no-op native stub for the unused finalizer reference. The observed output includes the full private key byte array:
text BoringSSLAsymmetricCipherKeyPair{privateKey=BoringSSLAsymmetricKeyParameter{bytes=[1, 2, 3, 4], isPrivate=true}, publicKey=BoringSSLAsymmetricKeyParameter{bytes=[5, 6, 7, 8], isPrivate=false}}
Minimal reproducer concept in the same package:
java package io.netty.incubator.codec.hpke.boringssl;
public final class VerifyPrivateKeyToString { public static void main(String[] args) { byte[] privateKey = new byte[] {1, 2, 3, 4}; byte[] publicKey = new byte[] {5, 6, 7, 8}; BoringSSLAsymmetricCipherKeyPair pair = new BoringSSLAsymmetricCipherKeyPair(privateKey, publicKey); System.out.println(pair.toString()); } }
The code path is deterministic: the production toString() methods concatenate the raw private-key byte array.
Impact
If an affected key pair or initialization exception is logged, application logs contain complete HPKE private key material. Anyone with access to those logs can recover the key. Depending on key reuse and log retention, this can compromise:
- confidentiality of OHTTP messages encrypted to the exposed key; - integrity/authenticity expectations for future messages if the key remains active; - incident response and key rotation assumptions, because logs may retain key material long after the in-memory key is rotated.
Suggested remediation
- Redact private key material in BoringSSLAsymmetricKeyParameter.toString() when isPrivate is true, for example bytes=<redacted> or only key type/length. - Redact privateKey in BoringSSLAsymmetricCipherKeyPair.toString(). - Remove Arrays.toString(privateKeyBytes) from BoringSSL.EVPHPKEKEYinitorthrow(...); report only length and KEM metadata. - Add regression tests asserting that toString() and exception messages do not contain private key byte values. - Consider making key pair classes avoid implementing detailed toString() for sensitive material entirely.
References
- codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java:72-78 - codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java:70-76 - codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java:228-232
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringsslto a version that resolves this vulnerability.Fixed in 0.0.23.Final - Configuration
Update BoringSSLAsymmetricCipherKeyPair.toString() so it does not concatenate or embed the private key object (avoid rendering privateKey entirely, e.g., replace with key type/length or "<redacted>").
io.netty.incubator.codec.hpke.boringssl.BoringSSLAsymmetricCipherKeyPair toString() = Redact private key material (lines 72-78: do not include "privateKey=" + privateKey which triggers key material via BoringSSLAsymmetricKeyParameter.toString) - Configuration
Change BoringSSLAsymmetricKeyParameter.toString() so that when isPrivate is true it redacts the byte array (e.g., "bytes=<redacted>" or only key type/length) instead of calling Arrays.toString(bytes).
io.netty.incubator.codec.hpke.boringssl.BoringSSLAsymmetricKeyParameter toString() = When isPrivate=true, render "bytes=<redacted>" (lines 70-76 currently: returns "bytes=" + Arrays.toString(bytes) regardless of isPrivate) - Configuration
Modify EVP_HPKE_KEY_init_or_throw error handling so IllegalArgumentException does not include Arrays.toString(privateKeyBytes); report only length and KEM metadata.
io.netty.incubator.codec.hpke.boringssl.BoringSSL (EVP_HPKE_KEY_init_or_throw) Exception message in IllegalArgumentException = Redact privateKeyBytes (lines 228-232 currently: "...: " + Arrays.toString(privateKeyBytes)) - Operational
Because logs/telemetry may already contain private key material from toString() output and exception messages, treat any potentially exposed keys as compromised and rotate/revocation should be performed per your incident response process.
Event History
Frequently Asked Questions
Which applications are exposed to private-key disclosure?
Applications using this BoringSSL HPKE classes artifact are exposed if they log BoringSSL asymmetric key-pair objects or log exceptions from failed native key initialization. Those logs can persist raw private-key bytes.
What conditions trigger the leak?
The leak occurs when BoringSSLAsymmetricCipherKeyPair.toString() is rendered, because it includes the private-key parameter, or when native key initialization fails and its IllegalArgumentException message is recorded. An attacker does not need to directly retrieve the key from the application if they can access logs containing these values.
What can be done before updating?
Avoid logging BoringSSL HPKE key-pair objects and do not record unredacted exception messages from native key initialization. Review and restrict access to existing application logs, since previously logged private-key material may already be persisted.