CVE-2025-68702: 
Java vulnerability analysis and mitigation

CVE-2025-68702 is a SHA-256 hex string padding bug in the Jervis library (Maven package net.gleske:jervis) that causes inconsistent hash lengths when computed hashes have leading zero bytes. The root cause is that SecurityIO.sha256Sum() uses padLeft(32, '0') instead of the correct padLeft(64, '0'), since SHA-256 produces 32 bytes which must be represented as 64 hex characters. All versions prior to 2.2 are affected. The vulnerability was published on January 13, 2026, and fixed in version 2.2. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory).

The flaw is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and resides in src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy at lines 622–626. The vulnerable code converts the SHA-256 digest to a hex string via new BigInteger(1, digest.digest()).toString(16).padLeft(32, '0'), which only pads to 32 characters instead of the required 64, causing truncated or inconsistently-lengthed hex strings whenever the hash has leading zero bytes. An unauthenticated remote attacker can exploit this via network access without any privileges or user interaction, targeting any system or consumer that directly uses the sha256Sum() method for hash-based comparisons or integrity validation (GitHub Advisory, Patch Commit).

The primary impact is an integrity failure: hash comparison operations may produce incorrect results when SHA-256 digests have leading zero bytes, potentially allowing an attacker to bypass authentication or data integrity checks that rely on consistent hash lengths. For internal library uses the severity is considered low, but for any consumer directly invoking the affected sha256Sum() methods, the risk is high — security controls such as checksum validation, JWT verification, or signature comparison could be circumvented. There is no confidentiality or availability impact; the vulnerability is limited to integrity (GitHub Advisory).

Upgrade Jervis to version 2.2 or later, which corrects the padding value from padLeft(32, '0') to padLeft(64, '0') in SecurityIO.sha256Sum(). If immediate upgrade is not possible, the advisory recommends using an alternate SHA-256 hash function as a temporary workaround. Priority should be given to systems where the sha256Sum() method is directly consumed by external systems or used in authentication and integrity validation flows. The fix commit is available at the Jervis repository (Patch Commit, GitHub Advisory).