CVE-2025-68703
High · 7.5Jervis's Salt for PBKDF2 derived from password
CVSS
7.5
EPSS
0.1%
Published
Jan 13, 2026
CISA due date
—
The record
Pre-computation attacks. Severity is considered low for internal uses of this library and high for consumers of this library.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | net.gleske:jervis | 0 | 2.2 |
Related vulnerabilities
- GHSA-36h5-vrq6-pp34 Jervis's Salt for PBKDF2 derived from password Same vulnerability
- GHSA-gxp5-mv27-vjcj Jervis's AES CBC Mode is Without Authentication Also affects net.gleske:jervis
- GHSA-5pq9-5mpr-jj85 Jervis Has a JWT Algorithm Confusion Vulnerability Also affects net.gleske:jervis
- GHSA-c9q6-g3hr-8gww Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis
- GHSA-67rj-pjg6-pq59 Jervis Has a SHA-256 Hex String Padding Bug Also affects net.gleske:jervis
- GHSA-crxp-chh4-9ghp Jervis has Deterministic AES IV Derivation from Passphrase Also affects net.gleske:jervis
- GHSA-mqw7-c5gg-xq97 Jervis Has a RSA PKCS#1 Padding Vulnerability Also affects net.gleske:jervis
- CVE-2025-68704 Jervis Has Weak Random for Timing Attack Mitigation Also affects net.gleske:jervis