Detections
Analytics

SCA: security update for bcrypt (GHSA-f27w-vcwj-c954)

high Tenable Cloud Security Plugin ID 439244

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version
 3.1.22, an integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the
 strengthening loop. Impacted applications must be setting the cost to 31 to see this happen. The JRuby
 implementation of bcrypt-ruby (`BCrypt.java`) computes the key-strengthening round count as a signed
 32-bit integer. When `cost=31` (the maximum allowed by the gem), signed integer overflow causes the round
 count to become negative, and the strengthening loop executes **zero iterations**. This collapses bcrypt
 from 2^31 rounds of exponential key-strengthening to effectively constant-time computation — only the
 initial EksBlowfish key setup and final 64x encryption phase remain. The resulting hash looks valid
 (`$2a$31$...`) and verifies correctly via `checkpw`, making the weakness invisible to the application.
 This issue is triggered only when cost=31 is used or when verifying a `$2a$31$` hash. This problem has
 been fixed in version 3.1.22. As a workaround, set the cost to something less than 31. (CVE-2026-33306)

Solution

Update the bcrypt library and its related packages to version 3.1.22 or later.

See Also

https://github.com/advisories/GHSA-f27w-vcwj-c954

Plugin Details

Severity: High

ID: 439244

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 3/26/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-33306

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.4

Threat Score: 4.5

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/19/2026

Vulnerability Publication Date: 3/19/2026

Reference Information

CVE: CVE-2026-33306

cwe: CWE-190