CVE-2025-68704
Medium · 5.9Jervis Has Weak Random for Timing Attack Mitigation
CVSS
5.9
EPSS
0.3%
Published
Jan 13, 2026
CISA due date
—
The record
If an attacker can predict the random delays, they may still be able to perform timing attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | net.gleske:jervis | 0 | 2.2 |
Related vulnerabilities
- GHSA-c9q6-g3hr-8gww Jervis Has Weak Random for Timing Attack Mitigation Same vulnerability
- GHSA-gxp5-mv27-vjcj Jervis's AES CBC Mode is Without Authentication Also affects net.gleske:jervis
- GHSA-5pq9-5mpr-jj85 Jervis Has a JWT Algorithm Confusion Vulnerability Also affects net.gleske:jervis
- GHSA-36h5-vrq6-pp34 Jervis's Salt for PBKDF2 derived from password Also affects net.gleske:jervis
- GHSA-67rj-pjg6-pq59 Jervis Has a SHA-256 Hex String Padding Bug Also affects net.gleske:jervis
- GHSA-crxp-chh4-9ghp Jervis has Deterministic AES IV Derivation from Passphrase Also affects net.gleske:jervis
- GHSA-mqw7-c5gg-xq97 Jervis Has a RSA PKCS#1 Padding Vulnerability Also affects net.gleske:jervis
- CVE-2025-68703 Jervis's Salt for PBKDF2 derived from password Also affects net.gleske:jervis