HighCVSS 7.5
PoC
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
Product
debian/ruby-json-jwt vulnerabilities
2 published CVES affecting debian/ruby-json-jwt, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest debian/ruby-json-jwt CVEs
Newest publication first
-
-
MediumCVSS 5.3 PoC
Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via netw...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.