CVE-2025-45765 Weak cryptography in n/a
The Ruby JWT library allows weak encryption keys, potentially enabling attackers to bypass security controls or decrypt data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-45765?
CVE-2025-45765 is a critical vulnerability in n/a, published on 7 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also."
Weakness: CWE-326
Which versions are affected by CVE-2025-45765?
How do I fix CVE-2025-45765?
No fix has been published for CVE-2025-45765 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-45765 being exploited?
There is no known exploitation of CVE-2025-45765 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-45765, GHSA-6ch4-944p-wf7j, UBUNTU-CVE-2025-45765.