{"id":"CVE-2026-45363","aliases":["DEBIAN-CVE-2026-45363","EUVD-2026-44516","GHSA-c32j-vqhx-rx3x","RHSA-2026:63327","RHSA-2026:63385","RHSA-2026:63386","RHSA-2026:63387","UBUNTU-CVE-2026-45363"],"status":"published","title":"`jwt` (Ruby gem) - empty-key HMAC bypass","description":"ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00364,"percentile":0.30672,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1391","CWE-287","CWE-326"],"published":"2026-05-18T17:24:55Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"RubyGems","package":"jwt","fixed_in":["3.2.0","2.10.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-jwt","fixed_in":["2.5.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-jwt","fixed_in":["2.7.1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-jwt","fixed_in":["3.2.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.0"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u1"}]}],"versions":["2.5.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-1+deb13u1"}]}],"versions":["2.7.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1"}]}],"versions":["2.7.1-1","3.1.2-1"]},{"source":"osv","ecosystem":"RubyGems","package":"jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.0"}]}],"versions":["3.0.0","3.1.0","3.1.1","3.1.2"]},{"source":"osv","ecosystem":"RubyGems","package":"jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3"}]}],"versions":["0.1.1","0.1.10","0.1.11","0.1.13","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","1.0.0","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.5.4","1.5.5","1.5.6","2.0.0","2.0.0.beta1","2.1.0","2.10.0","2.10.1","2.10.2","2.2.0","2.2.0.pre.beta.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0","2.4.0.beta1","2.4.1","2.5.0","2.6.0","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.9.0","2.9.1","2.9.2","2.9.3"]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el8pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el8sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.59-1.el9pc"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":22},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-5.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.73.30-3.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-5.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.73.30-3.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.18::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_maintenance:6.17::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"openvox-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.15.2-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.3-1.el9pc"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.3-1.el9sat"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-1","2.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.0-2","2.7.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","3.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-jwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1"]}],"products":[{"vendor":"jwt","product":"ruby-jwt"}],"references":[{"url":"https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964","tags":["x_refsource_MISC","fix","article","report"]},{"url":"https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/09/msg00022.html","tags":["web"]},{"url":"https://github.com/jwt/ruby-jwt/issues/724","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jwt/CVE-2026-45363.yml","tags":["web"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45363","tags":["web","advisory","report"]},{"url":"https://github.com/advisories/GHSA-c32j-vqhx-rx3x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45363.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45363","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45363","tags":["advisory"]},{"url":"https://github.com/jwt/ruby-jwt","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63327","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511026","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-48474","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63327.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10051","tags":["advisory"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45363","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5988","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-68494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68494","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/pull/1611","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9","tags":["article"]},{"url":"https://github.com/advisories/GHSA-72hv-8253-57qq","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18401","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69243","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13017","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/pull/13223","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63385","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-45592","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-46105","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48574","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48584","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48585","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48586","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48587","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48588","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48589","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48628","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63385.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11332","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332","tags":["advisory"]},{"url":"https://github.com/ansible/ansible","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503724","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16493","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16493","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73622","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73623","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73624","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73625","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519603","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76218","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76220","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76221","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76222","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63386","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-46099","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48690","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48691","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48692","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48693","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48697","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-49372","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63386.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:63387","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/SAT-42127","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-45924","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-48680","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63387.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45363","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-45363","title":"`jwt` (Ruby gem) - empty-key HMAC bypass","description":"ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.","status":"published","published":"2026-07-14T21:32:26.676Z","modified":"2026-09-19T18:07:54.033Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-287","CWE-326","CWE-1391"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-44516","description":"ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.","status":"published","published":"2026-07-14T21:32:26Z","modified":"2026-09-19T18:07:54Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:06.225065Z"}],"ghsa":[{"id":"GHSA-c32j-vqhx-rx3x","title":"ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351","description":"`JWT.decode(token, '', true, algorithm: 'HS256')` accepts an attacker-forged token.\n`OpenSSL::HMAC.digest('SHA256', '', payload)` returns a valid digest under an empty key, and no `raise\n  InvalidKeyError if key.empty?` precondition exists in the HMAC algorithm.\n\n```\nJWT.decode(token, \"\", true, algorithm: 'HS256')\n  -\u003e JWA::Hmac.verify(verification_key: \"\", ...)\n  -\u003e OpenSSL::HMAC.digest('SHA256', \"\", signing_input) == signature\n```\n\nThe same path is reached when a keyfinder block or key_finder: argument returns \"\", nil, or an\narray containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty\narrays, and JWT::JWA::Hmac silently coerces nil to \"\" (signing_key ||= '') before signing.\n\n```\nJWT.decode(token, nil, true, algorithms: ['HS256']) { |_h| \"\" }\n  -\u003e find_key returns \"\"               # \"\" \u0026\u0026 !Array(\"\").empty? == true\n  -\u003e JWA::Hmac.verify(verification_key: \"\", ...)\n  -\u003e verifies\n```\nCommon application patterns that produce the unsafe value: `redis.get(\"kid:#{kid}\").to_s`, ORM string columns with `default: ''`, `ENV['SECRET'] || '', Hash.new('')` lookups, [primary, fallback] where fallback may be nil. Applications passing a non-empty static key:, or whose keyfinder returns nil / raises on miss, are not affected.\n\nThe existing `enforce_hmac_key_length` option would block this but defaults to false. On OpenSSL ≥ 3.5 the empty-key HMAC.digest call no longer raises, so the OpenSSL-3.0 rescue in JWA::Hmac#sign does not fire.\n\nAffects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and\n`JWT::EncodedToken#verify_signature!(key_finder:)`","status":"published","published":"2026-05-18T17:24:55Z","modified":"2026-06-02T22:12:51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-287","CWE-326","CWE-1391"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-45363","description":"ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.","status":"published","published":"2026-07-14T22:16:54.463Z","modified":"2026-10-24T22:10:00.21Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-287","CWE-326","CWE-1391"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-45363","title":"`jwt` (Ruby gem) - empty-key HMAC bypass","description":"ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.","status":"published","published":"2026-07-14T21:32:26.676Z","modified":"2026-10-28T02:31:14.77032811Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-1391","CWE-287","CWE-326"],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"DEBIAN-CVE-2026-45363","description":"ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.","status":"published","published":"2026-07-14T22:16:54.463Z","modified":"2026-10-25T09:47:37.482650826Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-c32j-vqhx-rx3x","title":"ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351","description":"`JWT.decode(token, '', true, algorithm: 'HS256')` accepts an attacker-forged token.\n`OpenSSL::HMAC.digest('SHA256', '', payload)` returns a valid digest under an empty key, and no `raise\n  InvalidKeyError if key.empty?` precondition exists in the HMAC algorithm.\n\n```\nJWT.decode(token, \"\", true, algorithm: 'HS256')\n  -\u003e JWA::Hmac.verify(verification_key: \"\", ...)\n  -\u003e OpenSSL::HMAC.digest('SHA256', \"\", signing_input) == signature\n```\n\nThe same path is reached when a keyfinder block or key_finder: argument returns \"\", nil, or an\narray containing nil for an unknown key. JWT::Decode#find_key only rejects literal nil and empty\narrays, and JWT::JWA::Hmac silently coerces nil to \"\" (signing_key ||= '') before signing.\n\n```\nJWT.decode(token, nil, true, algorithms: ['HS256']) { |_h| \"\" }\n  -\u003e find_key returns \"\"               # \"\" \u0026\u0026 !Array(\"\").empty? == true\n  -\u003e JWA::Hmac.verify(verification_key: \"\", ...)\n  -\u003e verifies\n```\nCommon application patterns that produce the unsafe value: `redis.get(\"kid:#{kid}\").to_s`, ORM string columns with `default: ''`, `ENV['SECRET'] || '', Hash.new('')` lookups, [primary, fallback] where fallback may be nil. Applications passing a non-empty static key:, or whose keyfinder returns nil / raises on miss, are not affected.\n\nThe existing `enforce_hmac_key_length` option would block this but defaults to false. On OpenSSL ≥ 3.5 the empty-key HMAC.digest call no longer raises, so the OpenSSL-3.0 rescue in JWA::Hmac#sign does not fire.\n\nAffects HS256/HS384/HS512 via both JWT.decode (positional key and block keyfinder) and\n`JWT::EncodedToken#verify_signature!(key_finder:)`","status":"published","published":"2026-05-18T17:24:55Z","modified":"2026-09-10T03:50:46.749617476Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-1391","CWE-287","CWE-326"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"RHSA-2026:63327","title":"Red Hat Security Advisory: Satellite 6.16.13 Async Update","status":"published","published":"2026-09-04T10:14:01Z","modified":"2026-10-20T10:12:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63385","title":"Red Hat Security Advisory: Satellite 6.19.4 Async Update","status":"published","published":"2026-09-04T10:14:03Z","modified":"2026-10-20T10:12:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63386","title":"Red Hat Security Advisory: Satellite 6.18.9 Async Update","status":"published","published":"2026-09-04T10:14:03Z","modified":"2026-10-20T10:12:58Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:63387","title":"Red Hat Security Advisory: Satellite 6.17.11 Async Update","status":"published","published":"2026-09-04T10:14:04Z","modified":"2026-10-20T10:12:59Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"UBUNTU-CVE-2026-45363","description":"ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.","status":"published","published":"2026-07-14T22:16:00Z","modified":"2026-10-17T12:58:22.902289792Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:26.396868Z"}]}}