CVE-2025-68704 HIGH

CVE-2025-68704: Jervis has a Weak Random for Timing Attack Mitigation

Vendor Samrocketman
Product jervis
Weakness CWE-330 · Insufficient randomness
Published January 13, 2026
Last update January 13, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.

Key dates

02Disclosure timeline

January 13, 2026 CVE published
January 13, 2026 Record updated