CVE-2025-68702

The record

* Inconsistent hash lengths when leading bytes are zero * Comparison failures for hashes with leading zeros * Potential security issues in hash-based comparisons * Could cause subtle bugs in systems relying on consistent hash lengths Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

Affected packages

Related vulnerabilities

• GHSA-67rj-pjg6-pq59 Jervis Has a SHA-256 Hex String Padding Bug Same vulnerability
• GHSA-gxp5-mv27-vjcj Jervis's AES CBC Mode is Without Authentication Also affects net.gleske:jervis
• GHSA-5pq9-5mpr-jj85 Jervis Has a JWT Algorithm Confusion Vulnerability Also affects net.gleske:jervis
• GHSA-c9q6-g3hr-8gww Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis
• GHSA-36h5-vrq6-pp34 Jervis's Salt for PBKDF2 derived from password Also affects net.gleske:jervis
• GHSA-crxp-chh4-9ghp Jervis has Deterministic AES IV Derivation from Passphrase Also affects net.gleske:jervis
• GHSA-mqw7-c5gg-xq97 Jervis Has a RSA PKCS#1 Padding Vulnerability Also affects net.gleske:jervis
• CVE-2025-68704 Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis