NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · RubyGems

CVE-2025-54887: JWE is missing AES-GCM authentication tag validation in encrypted JWE

criticalCVSS 3.1 9.1GHSA-c7p4-hx26-pr73

Overview The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. Impact - JWEs can be modified to decrypt to an arbitrary value - JWEs can be decrypted by observing parsing differences - The GCM internal GHASH key%20is%20the-,hash%20key,-%2C%20a%20string%20of) can be recovered Am I Affected? You are affected by…

Published Aug 7, 2025 · Updated Aug 8, 2025

Affected packages

jwe

Ecosystem
RubyGems
Affected
<= 1.1.0
Fixed in
1.1.1
Check
bundle info jwe

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Overview

The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs.

Impact

  • JWEs can be modified to decrypt to an arbitrary value
  • JWEs can be decrypted by observing parsing differences
  • The GCM internal GHASH key%20is%20the-,hash%20key,-%2C%20a%20string%20of) can be recovered

Am I Affected?

You are affected by this vulnerability even if you do not use an AES-GCM encryption algorithm for your JWEs.

Patches

The version 1.1.1 fixes the issue by adding the tag length check for the AES-GCM algorithm.

Important: As the GHASH key%20is%20the-,hash%20key,-%2C%20a%20string%20of) could have leaked, you must rotate the encryption keys after upgrading to version 1.1.1.

References

Félix Charette talk at NorthSec 2025 about the issue

Credited to Sideni.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology