Jervis Has a SHA-256 Hex String Padding Bug

HIGH 7.5CVE-2025-68702 · GHSA-67rj-pjg6-pq59 · Published 13/01/2026 · updated 17/06/2026

In short

CVE-2025-68702 is a HIGH (CVSS 7.5) vulnerability affecting net.gleske:jervis, jervis (samrocketman).
Chance of exploitation in the next 30 days (EPSS): 0.17%, higher than 7.0% of all vulnerabilities.
Fix: update to 2.2 or later.

Package	Affected versions	Patched versions
net.gleske:jervis Maven	`< 2.2`	`2.2`
jervis samrocketman	`< 2.2`	`2.2`

Description

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626

padLeft(32, '0') should be padLeft(64, '0'). SHA-256 produces 32 bytes = 64 hex characters.

Impact

Inconsistent hash lengths when leading bytes are zero
Comparison failures for hashes with leading zeros
Potential security issues in hash-based comparisons
Could cause subtle bugs in systems relying on consistent hash lengths

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

Patches

Upgrade to Jervis 2.2.

Workarounds

Use an alternate SHA-256 hash function or upgrade.

NVD description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it should use padLeft(64, '0') because SHA-256 produces 32 bytes which equates to 64 hex characters. This vulnerability is fixed in 2.2.

References

samrocketman/jervis security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-68702 · ADVISORY
samrocketman/jervis commit c3981ff · WEB
samrocketman/jervis · PACKAGE
samrocketman/jervis · WEB
samrocketman/jervis commit c3981ff · WEB

More vulnerabilities in net.gleske:jervis

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

net.gleske:jervis

Maven

< 2.2

2.2

jervis

samrocketman

< 2.2

2.2

Description

Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626

padLeft(32, '0') should be padLeft(64, '0'). SHA-256 produces 32 bytes = 64 hex characters.

Impact

Inconsistent hash lengths when leading bytes are zero
Comparison failures for hashes with leading zeros
Potential security issues in hash-based comparisons
Could cause subtle bugs in systems relying on consistent hash lengths

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

Patches

Upgrade to Jervis 2.2.

Workarounds

Use an alternate SHA-256 hash function or upgrade.

NVD description

More vulnerabilities in net.gleske:jervis

See all →