What’s Vulnerable › Vulnerabilities

CVE-2022-29249: Reversible One-Way Hash and Use of a Broken or Risky Cryptographic Algorithm in io.github.javaezlib.JavaEZ

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-24 · updated 2026-06-17
• Weakness: CWE-327

Description

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.

Affected products

• JavaEZLib JavaEZ: 1.6

References

• https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7
• https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8
• https://github.com/JavaEZLib/JavaEZ/releases/tag/1.7
• https://github.com/JavaEZLib/JavaEZ/security/advisories/GHSA-67fj-6w6m-w5j8

Get alerted when CVE-2022-29249 or the next vulnerability affects your stack