MAVEN · AUGUST 2026 · EARLY WARNING

netty-incubator-codec-ohttp-hpke-classes-boringssl Package Vulnerability Alert

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (maven)
Affected versions
< 0.0.23.Final or >= 0.0.10.Final, <= 0.0.10.Final or >= 0.0.11.Final, <= 0.0.11.Final or >= 0.0.12.Final, <= 0.0.12.Final or >= 0.0.13.Final, <= 0.0.13.Final or >= 0.0.14.Final, <= 0.0.14.Final or >= 0.0.15.Final, <= 0.0.15.Final or >= 0.0.16.Final, <= 0.0.16.Final or >= 0.0.17.Final, <= 0.0.17.Final or >= 0.0.18.Final, <= 0.0.18.Final or >= 0.0.19.Final, <= 0.0.19.Final or >= 0.0.20.Final, <= 0.0.20.Final or >= 0.0.21.Final, <= 0.0.21.Final or >= 0.0.22.Final, <= 0.0.22.Final or >= 0.0.3.Final, <= 0.0.3.Final or >= 0.0.4.Final, <= 0.0.4.Final or >= 0.0.5.Final, <= 0.0.5.Final or >= 0.0.6.Final, <= 0.0.6.Final or >= 0.0.7.Final, <= 0.0.7.Final or >= 0.0.8.Final, <= 0.0.8.Final or >= 0.0.9.Final, <= 0.0.9.Final
Patched version
Not yet available
GHSA-2MC4-J865-9Q4R

The netty-incubator-codec-ohttp-hpke-classes-boringssl Maven package reportedly exposes raw HPKE private key bytes in string representations and error messages. Applications that log key-pair objects or exceptions may persist private key material in logs.

What happened

An early warning has been issued for the netty-incubator-codec-ohttp-hpke-classes-boringssl Maven package. This package appears to expose raw HPKE private key bytes in string representations and error messages. Applications that log key-pair objects or exceptions can potentially persist private key material in logs. This issue is under investigation and has not been exploited in the wild as of the latest reports.

The affected versions include all versions less than 0.0.23.Final or any version between 0.0.10.Final and 0.0.22.Final inclusive. Additionally, versions 0.0.3.Final to 0.0.9.Final are also affected. The issue stems from the toString() method and exception messages that inadvertently expose sensitive key material.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using netty-incubator-codec-ohttp-hpke-classes-boringssl in versions less than 0.0.23.Final or any version between 0.0.10.Final and 0.0.22.Final inclusive, or versions 0.0.3.Final to 0.0.9.Final.

What should I do right now?

Upgrade to a fixed version of the package and review your logs for any exposed private key material. Monitor the primary sources for updates on a patched version.

Is there an official fix available?

No official fix has been published yet. Monitor the primary sources for updates.

How can I prevent future exposure of private keys?

Implement additional logging safeguards to ensure sensitive key material is not persisted in logs.

Sources

Join the 0Day waitlist →

← Back to all threats