CVE-2026-45363 漏洞深度分析

漏洞概述

CVE 编号： CVE-2026-45363
CVSS 评分： 9.1（CRITICAL）
CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE 分类： CWE-287,CWE-326,CWE-1391
漏洞状态： Received
发布时间： 2026-07-14T22:16:54.463
最后更新： 2026-07-14T22:16:54.463

漏洞描述

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_finder: argument returns an empty string, nil, or an array containing nil for an unknown key, affecting HS256, HS384, and HS512 verification through JWT.decode and JWT::EncodedToken#verify_signature!. This issue is fixed in versions 2.10.3 and 3.2.0.

影响分析

此漏洞的具体影响取决于实际利用场景。"

修复建议

1. 及时关注厂商发布的安全更新和补丁
2. 升级受影响组件到最新版本
3. 如无法立即升级，参考厂商提供的临时缓解措施
4. 加强网络访问控制和监控

参考链接

1. https://github.com/jwt/ruby-jwt/commit/9820020869ad147b941e49d96ab8beba35532964
2. https://github.com/jwt/ruby-jwt/commit/db560b769a07bd9724e77ff505011ac01872106f
3. https://github.com/jwt/ruby-jwt/releases/tag/v2.10.3
4. https://github.com/jwt/ruby-jwt/releases/tag/v3.2.0
5. https://github.com/jwt/ruby-jwt/security/advisories/GHSA-c32j-vqhx-rx3x