Insecure hybrid cryptography
Published: November 11, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-586r-mm5q-xhg2
- Vendor Advisory: https://github.com/ankane/lockbox/security/advisories/GHSA-586r-mm5q-xhg2
GEM
SEVERITY
CVSS v3.x: 4.9 (Medium)
UNAFFECTED VERSIONS
< 0.1.1
PATCHED VERSIONS
>= 2.3.0
DESCRIPTION
With hybrid cryptography, an attacker who obtains the encryption key can use it to decrypt data (acting as symmetric encryption rather than asymmetric).