Which versions of Java are affected by CVE-2026-33306?

CVE-2026-33306 presents moderate security risk, a integer overflow vulnerability. Exploitation could cause memory corruption or application crashes.. A patch is available.

How to fix or mitigate CVE-2026-33306?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Java CVE-2026-33306

Q: What is the CVSS score of CVE-2026-33306?

CVE-2026-33306 has a CVSS 4.0 base score of 4.5 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-03-19 https://github.com/bcrypt-ruby/bcrypt-ruby

GHSA-f27w-vcwj-c954

Java Integer Overflow Buffer Overflow Red Hat bcrypt

4.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.5 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

6.7 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 18:00 vuln.today

CVE Published

Mar 19, 2026 - 17:54 nvd

MEDIUM 4.5

DescriptionGitHub Advisory

Impact

An integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the strengthening loop. Impacted applications must be setting the cost to 31 to see this happen.

The JRuby implementation of bcrypt-ruby (BCrypt.java) computes the key-strengthening round count as a signed 32-bit integer. When cost=31 (the maximum allowed by the gem), signed integer overflow causes the round count to become negative, and the strengthening loop executes zero iterations. This collapses bcrypt from 2^31 rounds of exponential key-strengthening to effectively constant-time computation - only the initial EksBlowfish key setup and final 64x encryption phase remain.

The resulting hash looks valid ($2a$31$...) and verifies correctly via checkpw, making the weakness invisible to the application. This issue is triggered only when cost=31 is used or when verifying a $2a$31$ hash.

Patches

This problem has been fixed in version 3.1.22

Workarounds

Set the cost to something less than 31.

AnalysisAI

JRuby's BCrypt implementation suffers from a signed integer overflow when the cost parameter is set to 31, causing the key-strengthening loop to execute zero iterations and reducing password hashing to a negligible computational cost. Applications using bcrypt-ruby with cost=31 generate seemingly valid hashes that verify correctly but provide virtually no protection against brute-force attacks. No patch is currently available for this vulnerability.

Technical ContextAI

An integer overflow occurs when an arithmetic operation produces a value that exceeds the maximum (or minimum) size of the integer type used to store it. This vulnerability is classified as Integer Overflow or Wraparound (CWE-190).