Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

jwe

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1RubyGemsPublished

    JWE is missing AES-GCM authentication tag validation in encrypted JWE

    CVE-2025-54887 · GHSA-c7p4-hx26-pr73

    Affected
    • RubyGems jwe <= 1.1.0
    Fixed in
    1.1.1· Vendor fix available
    Issue
    The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. Impact - JWEs can be modified to decrypt to an arbitrary value - JWEs can be decrypted by observing parsing differences - The GCM internal GHASH key%20is%20the-,hash%20key,-%2C%20a%20string%20of) can be recovered Am I Affected? You are affected by this vulnerability even if you do not use an AES-GCM encryption algorithm for your JWEs. Patches The version 1.1.1 fixes the issue by adding the tag length check for the AES-GCM algorithm. Important: As the GHASH key%20is%20the-,hash%20key,-%2C%20a%20string%20of) could have leaked, you must rotate the encryption keys after upgrading to version 1.1.1. References Félix Charette talk at NorthSec 2025 about the issue

    Recommended action: Upgrade to 1.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →