CVE-2025-68702: Jervis SHA-256 Hex String Padding Bug
Summary
CVE-2025-68702: Jervis Has a SHA-256 Hex String Padding Bug. Affects net.gleske:jervis versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jervis is an open-source library designed for continuous integration and deployment, primarily used in Java-based projects. It provides various tools for managing build processes, including security features for handling cryptographic operations. However, a recent vulnerability has been identified that affects its SHA-256 hashing functionality, leading to potential inconsistencies in hash lengths.
Vulnerability Detail
The vulnerability arises from a bug in the padding function used for SHA-256 hex strings. Specifically, the function incorrectly pads the output to 32 characters instead of the required 64 characters, which is necessary for representing the full 32-byte output of SHA-256. This can lead to inconsistent hash lengths when leading bytes are zero, resulting in comparison failures for hashes with leading zeros. The implications of this bug include potential security issues in hash-based comparisons and subtle bugs in systems that rely on consistent hash lengths.
How To Fix
Latest published version: 2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider using an alternate SHA-256 hash function until the library can be upgraded. This can be done by implementing a custom hashing function or using a different library that provides a compliant SHA-256 implementation.
Conclusion
The SHA-256 hex string padding bug in the Jervis library poses a significant risk for applications relying on consistent hash lengths. It is crucial to upgrade to the patched version to mitigate potential security issues. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for net.gleske:jervis →
FAQ
The vulnerability is a padding bug in the SHA-256 hex string output, which can lead to inconsistent hash lengths.
It can cause comparison failures in hash-based operations, potentially leading to security issues and bugs in your application.
The vulnerability has a CVSS score of 8.7, indicating a high severity level, especially for applications directly using the affected methods.
Yes, upgrading to Jervis version 2.2 or later resolves the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.gleske:jervis.
