CVE-2026-61798: netty-incubator-codec-ohttp BoringSSL HPKE Private Key Exposure via toString()

// Run inside the io.netty.incubator.codec.hpke.boringssl package.
// No exploit delivery needed: the vulnerability fires on any toString() or log call.

public final class VerifyPrivateKeyToString {
  public static void main(String[] args) {
    byte[] privateKey = new byte[] {1, 2, 3, 4};
    byte[] publicKey  = new byte[] {5, 6, 7, 8};
    BoringSSLAsymmetricCipherKeyPair pair =
        new BoringSSLAsymmetricCipherKeyPair(privateKey, publicKey);
    // Any logger.debug(pair) or System.out.println(pair) produces:
    System.out.println(pair.toString());
    // Output:
    // BoringSSLAsymmetricCipherKeyPair{privateKey=BoringSSLAsymmetricKeyParameter{bytes=[1, 2, 3, 4], isPrivate=true}, publicKey=BoringSSLAsymmetricKeyParameter{bytes=[5, 6, 7, 8], isPrivate=false}}

    // Second path: pass a malformed key to trigger the exception message.
    // EVP_HPKE_KEY_init_or_throw will throw:
    // IllegalArgumentException: privateKeyBytes does not contain a valid private key: [1, 2, 3, 4]
  }
}