{"cve":"CVE-2025-45765","nvd":{"published":"2025-08-07T21:15:27.570","modified":"2026-06-17T09:25:40.503","status":"Deferred","description":"ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is \"keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also.\"","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":9.1},"cwes":["CWE-326"],"references":["https://gist.github.com/ZupeiNie/c621253068ce5b64911629534879e8f9","https://github.com/jwt/ruby-jwt/issues/668"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:06:45.861874017+00:00"},"epss":{"cve":"CVE-2025-45765","score":0.00172,"percentile":0.06607,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}