What is GHSA-67rj-pjg6-pq59?

GHSA-67rj-pjg6-pq59 is a security advisory published by GitHub Security Advisories with High severity. Jervis Has a SHA-256 Hex String Padding Bug

Which CVE IDs does GHSA-67rj-pjg6-pq59 cover?

GHSA-67rj-pjg6-pq59 covers the following CVE IDs: CVE-2025-68702. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-67rj-pjg6-pq59?

GHSA-67rj-pjg6-pq59 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-67rj-pjg6-pq59?

GHSA-67rj-pjg6-pq59 affects 1 product, including: maven/net.gleske:jervis:\u003c 2.2.

GHSA-67rj-pjg6-pq59HighCVSS 7.5

Jervis Has a SHA-256 Hex String Padding Bug

Vendor

GitHub Security Advisories

Published

January 13, 2026

Last Modified

January 21, 2026

🔗 CVE IDs covered (1)

CVE-2025-68702 →

📋 Description

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626

padLeft(32, '0') should be padLeft(64, '0'). SHA-256 produces 32 bytes = 64 hex characters.

Impact

Inconsistent hash lengths when leading bytes are zero
Comparison failures for hashes with leading zeros
Potential security issues in hash-based comparisons
Could cause subtle bugs in systems relying on consistent hash lengths

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

Patches

Upgrade to Jervis 2.2.

Workarounds

Use an alternate SHA-256 hash function or upgrade.

🎯 Affected products1

maven/net.gleske:jervis:< 2.2