PT-2026-26246 · Openbsd+1 · Openbsd Bcrypt+1

Lowtenderlove · Published 2026-01-01 · Updated 2026-03-27 · CVE-2026-33306

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions bcrypt-ruby versions prior to 3.1.22

Description The bcrypt-ruby gem, a Ruby binding for the OpenBSD bcrypt() password hashing algorithm, contains a flaw in its Java BCrypt implementation for JRuby. Specifically, an integer overflow in the BCrypt.java file occurs when the cost parameter is set to 31. This overflow results in zero iterations during the key-strengthening loop, effectively reducing the bcrypt process to constant-time computation. The resulting hash appears valid and can be verified using checkpw, concealing the weakness. This issue is triggered only when cost=31 is used or when verifying a $2a$31$ hash.

Recommendations Upgrade to bcrypt-ruby version 3.1.22 or later. As a workaround, set the cost parameter to a value less than 31.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-33306

GHSA-F27W-VCWJ-C954

OESA-2026-1723

Affected Products

Openbsd Bcrypt

Ruby-Bcrypt

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33306.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bcrypt/CVE-2026-33306.yml · Exploit
• https://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4 · Patch
• https://github.com/bcrypt-ruby/bcrypt-ruby/security/advisories/GHSA-f27w-vcwj-c954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33306 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33306 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33306 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33306 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33306 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33306 · Security Note
• https://osv.dev/vulnerability/GHSA-f27w-vcwj-c954 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33306 · Vendor Advisory
• https://github.com/bcrypt-ruby/bcrypt-ruby/releases/tag/v3.1.22 · Note
• https://github.com/bcrypt-ruby/bcrypt-ruby · Note