CVE-2026-33306

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33306", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T21:23:36.675Z", "datePublished": "2026-03-24T00:08:00.451Z", "dateUpdated": "2026-03-24T15:39:03.590Z"}, "containers": {"cna": {"title": "bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954"}, {"name": "https://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4", "tags": ["x_refsource_MISC"], "url": "https://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4"}, {"name": "https://github.com/bcrypt-ruby/bcrypt-ruby/releases/tag/v3.1.22", "tags": ["x_refsource_MISC"], "url": "https://github.com/bcrypt-ruby/bcrypt-ruby/releases/tag/v3.1.22"}], "affected": [{"vendor": "bcrypt-ruby", "product": "bcrypt-ruby", "versions": [{"version": "< 3.1.22", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T00:08:00.451Z"}, "descriptions": [{"lang": "en", "value": "bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the strengthening loop. Impacted applications must be setting the cost to 31 to see this happen. The JRuby implementation of bcrypt-ruby (`BCrypt.java`) computes the key-strengthening round count as a signed 32-bit integer. When `cost=31` (the maximum allowed by the gem), signed integer overflow causes the round count to become negative, and the strengthening loop executes **zero iterations**. This collapses bcrypt from 2^31 rounds of exponential key-strengthening to effectively constant-time computation \u2014 only the initial EksBlowfish key setup and final 64x encryption phase remain. The resulting hash looks valid (`$2a$31$...`) and verifies correctly via `checkpw`, making the weakness invisible to the application. This issue is triggered only when cost=31 is used or when verifying a `$2a$31$` hash. This problem has been fixed in version 3.1.22. As a workaround, set the cost to something less than 31."}], "source": {"advisory": "GHSA-f27w-vcwj-c954", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T15:38:08.809169Z", "id": "CVE-2026-33306", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:39:03.590Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33306", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T15:38:08.809169Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T15:38:54.236Z"}}], "cna": {"title": "bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby", "source": {"advisory": "GHSA-f27w-vcwj-c954", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bcrypt-ruby", "product": "bcrypt-ruby", "versions": [{"status": "affected", "version": "< 3.1.22"}]}], "references": [{"url": "https://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954", "name": "https://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4", "name": "https://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bcrypt-ruby/bcrypt-ruby/releases/tag/v3.1.22", "name": "https://github.com/bcrypt-ruby/bcrypt-ruby/releases/tag/v3.1.22", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the strengthening loop. Impacted applications must be setting the cost to 31 to see this happen. The JRuby implementation of bcrypt-ruby (`BCrypt.java`) computes the key-strengthening round count as a signed 32-bit integer. When `cost=31` (the maximum allowed by the gem), signed integer overflow causes the round count to become negative, and the strengthening loop executes **zero iterations**. This collapses bcrypt from 2^31 rounds of exponential key-strengthening to effectively constant-time computation \u2014 only the initial EksBlowfish key setup and final 64x encryption phase remain. The resulting hash looks valid (`$2a$31$...`) and verifies correctly via `checkpw`, making the weakness invisible to the application. This issue is triggered only when cost=31 is used or when verifying a `$2a$31$` hash. This problem has been fixed in version 3.1.22. As a workaround, set the cost to something less than 31."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T00:08:00.451Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33306", "state": "PUBLISHED", "dateUpdated": "2026-03-24T15:39:03.590Z", "dateReserved": "2026-03-18T21:23:36.675Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-24T00:08:00.451Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bcrypt-ruby", "vendor": "bcrypt-ruby", "versions": [{"status": "affected", "version": "< 3.1.22"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bcrypt-ruby_project:bcrypt-ruby:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "0D02AC8C-3DF6-4BED-A30A-FA0463020503", "versionEndExcluding": "3.1.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the strengthening loop. Impacted applications must be setting the cost to 31 to see this happen. The JRuby implementation of bcrypt-ruby (`BCrypt.java`) computes the key-strengthening round count as a signed 32-bit integer. When `cost=31` (the maximum allowed by the gem), signed integer overflow causes the round count to become negative, and the strengthening loop executes **zero iterations**. This collapses bcrypt from 2^31 rounds of exponential key-strengthening to effectively constant-time computation \u2014 only the initial EksBlowfish key setup and final 64x encryption phase remain. The resulting hash looks valid (`$2a$31$...`) and verifies correctly via `checkpw`, making the weakness invisible to the application. This issue is triggered only when cost=31 is used or when verifying a `$2a$31$` hash. This problem has been fixed in version 3.1.22. As a workaround, set the cost to something less than 31."}, {"lang": "es", "value": "bcrypt-ruby es un enlace Ruby para el algoritmo de hash de contrase\u00f1as bcrypt() de OpenBSD. Antes de la versi\u00f3n 3.1.22, un desbordamiento de entero en la implementaci\u00f3n Java de BCrypt para JRuby puede causar cero iteraciones en el bucle de fortalecimiento. Las aplicaciones afectadas deben estar configurando el costo en 31 para que esto ocurra. La implementaci\u00f3n de JRuby de bcrypt-ruby ('BCrypt.java') calcula el recuento de rondas de fortalecimiento de clave como un entero con signo de 32 bits. Cuando 'cost=31' (el m\u00e1ximo permitido por la gema), el desbordamiento de entero con signo hace que el recuento de rondas se vuelva negativo, y el bucle de fortalecimiento ejecuta cero iteraciones. Esto colapsa bcrypt de 2^31 rondas de fortalecimiento exponencial de clave a una computaci\u00f3n en tiempo efectivamente constante \u2014 solo quedan la configuraci\u00f3n inicial de clave EksBlowfish y la fase final de cifrado 64x. El hash resultante parece v\u00e1lido ('$2a$31$...') y se verifica correctamente a trav\u00e9s de 'checkpw', haciendo que la debilidad sea invisible para la aplicaci\u00f3n. Este problema se activa solo cuando se usa cost=31 o al verificar un hash '$2a$31$'. Este problema ha sido solucionado en la versi\u00f3n 3.1.22. Como soluci\u00f3n alternativa, configure el costo en algo menor que 31."}], "id": "CVE-2026-33306", "lastModified": "2026-06-17T10:37:17.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33306", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T15:38:08.809169Z", "version": "2.0.3"}}]}, "published": "2026-03-24T01:17:02.037", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/bcrypt-ruby/bcrypt-ruby/releases/tag/v3.1.22"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/bcrypt-ruby/bcrypt-ruby: bcrypt-ruby (JRuby): Weakened password hashing due to integer overflow", "id": "2450565", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450565"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in bcrypt-ruby, a Ruby binding for the OpenBSD bcrypt() password hashing algorithm, specifically in its JRuby implementation. When the cost parameter is set to 31, an integer overflow occurs, causing the key-strengthening loop to execute zero iterations. This significantly weakens the generated password hashes, effectively reducing the computational effort required to crack them. An attacker could leverage this to more easily compromise user accounts protected by affected applications."], "name": "CVE-2026-33306", "package_state": [{"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "rubygem-bcrypt", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "satellite:el8/rubygem-bcrypt", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-03-24T00:08:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-33306\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33306\nhttps://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4\nhttps://github.com/bcrypt-ruby/bcrypt-ruby/releases/tag/v3.1.22\nhttps://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "bcrypt-ruby", "source": "cna", "vendor": "bcrypt-ruby"}, "product": "bcrypt-ruby", "vendor": "bcrypt-ruby"}], "analysis": {"en": {"generated_at": "2026-03-30T15:23:56.429499+00:00", "value": {"mitigation_remediation": ["Upgrade bcrypt-ruby to version 3.1.22 or newer.", "If upgrading is not possible, configure the cost parameter to a value lower than 31.", "Review existing password hashes; rehash any that use the $2a$31$ prefix if feasible.", "Ensure the application uses the vetted Ruby implementation rather than JRuby when possible.", "Verify that the system is not exposing password hashes externally; limit access to stored credentials."], "summary": {"action": "Patch Immediately", "impact": "Weakened password hash strength due to zero key\u2011strengthening iterations when cost is set to 31 in JRuby"}, "threat_synthesis": {"affected_systems": "Affected systems are applications that employ the bcrypt\u2011ruby library prior to release 3.1.22 and configure the cost to 31 or later validate password hashes that begin with \\\"$2a$31$\\\". The vendor noted that the issue applies only to JRuby's implementation; native Ruby implementations are unaffected. Any deployment using older gem versions with cost=31 will generate weak hashes.", "description_and_impact": "The vulnerability is an integer overflow in the Java BCrypt implementation within the bcrypt\u2011ruby gem for JRuby. When the cost parameter, which determines the number of key\u2011strengthening rounds, is set to its maximum value of 31, the signed 32\u2011bit calculation overflows and the resulting round count becomes negative. The strengthening loop therefore executes zero iterations, collapsing the intended 2^31 rounds into a single, constant\u2011time computation. As the resulting hash still appears valid and passes verification, the weakness is invisible to the application.", "risk_and_exploitability": "The CVSS score of 4.5 indicates moderate severity, and the EPSS score of under 1% suggests a low probability of exploitation at this time. The weakness is not listed in the CISA KEV catalog, and no active exploit is known. However, because the flaw allows attackers who can obtain the hash to compute it quickly, the risk escalates for systems that use high cost values and store password hashes locally. The likely vector is offline password cracking, inferred from the nature of the vulnerability; no network exposure is required beyond acquiring the hash."}}}}, "created": "2026-03-24T10:29:38.071297+00:00", "updated": "2026-03-30T20:58:11.585017+00:00", "vendors": ["bcrypt-ruby", "bcrypt-ruby$PRODUCT$bcrypt-ruby"]}