GHSA-c7p4-hx26-pr73 JWE is missing AES-GCM authentication tag validation in encrypted JWE

• RubyGems jwe: < 1.1.1 → fixed in 1.1.1

Overview The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. Impact • JWEs can be modified to decrypt to an arbitrary value • JWEs can be decrypted by observing parsing differences • The GCM internal GHASH key%20is%20the-,hash%20key,-%2C%20a%20string%20of) can be recovered Am I Affected? You are affected by this vulnerability even if you do not use an `AES-GCM` encryption algorithm for your JWEs. Patches The version 1.1.1 fixes the issue by adding the tag length check for the `AES-GCM` algorithm. Important: As the GHASH key%20is%20the-,hash%20key,-%2C%20a%20string%20of) could have leaked, you must rotate the encryption keys after upgrading to version 1.1.1. References Félix Charette talk at NorthSec 2025 about the issue