GitHub Advisoryadvisory · Maven

GHSA-67rj-pjg6-pq59 Jervis Has a SHA-256 Hex String Padding Bug

HIGH Published 2026-01-13 Modified 2026-01-21 Official page ↗
Aliases
CVE-2025-68702
Ecosystem
Maven
Packages
net.gleske:jervis
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-327
Reviewed
2026-01-13

Affected packages

• Maven net.gleske:jervis: < 2.2 → fixed in 2.2

Description

Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626 `padLeft(32, '0')` should be `padLeft(64, '0')`. SHA-256 produces 32 bytes = 64 hex characters. Impact • Inconsistent hash lengths when leading bytes are zero • Comparison failures for hashes with leading zeros • Potential security issues in hash-based comparisons • Could cause subtle bugs in systems relying on consistent hash lengths Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high. Patches Upgrade to Jervis 2.2. Workarounds Use an alternate SHA-256 hash function or upgrade.

Related

Alias · CVE (1)

  • CVE-2025-68702 Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References