CVE-2025-68704: Jervis Package Suffers from Weak Randomness Leading to Timing Attack Vulnerability
Summary
CVE-2025-68704: Jervis Has Weak Random for Timing Attack Mitigation. Affects net.gleske:jervis versions < 2.2. Fixed in 2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jervis is an open-source continuous integration tool designed for managing and automating software builds and deployments. It leverages Groovy for scripting and is built on the Maven ecosystem. The package is widely used for its flexibility and ease of integration with various development workflows. However, it has been identified to use a non-cryptographically secure random number generator, which exposes it to potential timing attacks.
Vulnerability Detail
The vulnerability arises from the use of java.util.Random() in the Jervis package, which is not suitable for cryptographic purposes. This weakness allows attackers to predict random delays, potentially enabling them to execute timing attacks. Such attacks can compromise the security of applications by allowing unauthorized access or manipulation of sensitive data. The specific lines of code responsible for this issue can be found in the SecurityIO.groovy file of the Jervis source code.
How To Fix
Latest published version: 2.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version of Jervis.
Conclusion
The identified vulnerability in the Jervis package, CVE-2025-68704, poses a significant risk due to its reliance on weak randomness for timing attack mitigation. Users are strongly advised to upgrade to version 2.2 or later to ensure the security of their applications.
See every vulnerability recorded for net.gleske:jervis →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
If your application uses Jervis and relies on its randomization features, it may be susceptible to timing attacks, which could lead to unauthorized access or data manipulation.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
While there are no workarounds available, it is crucial to prioritize upgrading to the latest version of Jervis as soon as possible to mitigate the risk.
The vulnerability originates from the use of java.util.Random() in the Jervis codebase, which is not cryptographically secure and can lead to predictable random delays.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.gleske:jervis.
