CVE-2026-33306

A flaw was found in bcrypt-ruby, a Ruby binding for the OpenBSD bcrypt() password hashing algorithm, specifically in its JRuby implementation. When the cost parameter is set to 31, an integer overflow occurs, causing the key-strengthening loop to execute zero iterations. This significantly weakens the generated password hashes, effectively reducing the computational effort required to crack them. An attacker could leverage this to more easily compromise user accounts protected by affected applications.