CVE-2025-27508 json
Emissary Use of a Broken or Risky Cryptographic Algorithm
published 2025-03-05 20 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-6146 , GHSA-hw43-fcmm-3m5g
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or defaults to algorithms that are no longer recommended for secure cryptographic use cases (e.g., SHA-1, CRC32, and SSDEEP). These algorithms, while possibly valid for certain non-security-critical tasks, can expose users to security risks if used in scenarios where strong cryptographic guarantees are required. This issue is fixed in 8.24.0.
Patch / fix
- maven gov.nsa.emissary:emissary 8.24.0
- gov.nsa.emissary emissary 8.24.0
- nsa emissary 8.24.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-hw43-fcmm-3m5g referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | gov.nsa.emissary:emissary | <8.24.0 |
8.24.0 |
Affected products
- NationalSecurityAgency emissary
Classification
- Weakness
-
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
References
-
github.com
/NationalSecurityAgency/emissary/commit/da3a81a8977577597ff2a944820a5ae4e9762368
web
-
github.com
/NationalSecurityAgency/emissary/security/advisories/GHSA-hw43-fcmm-3m5g
exploit, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-27508
advisory
-
github.com
/NationalSecurityAgency/emissary
package
-
github.com
/NationalSecurityAgency/emissary/releases/tag/8.24.0
web
Sources
- CVE List CVE-2025-27508
- GitHub Advisory GHSA-hw43-fcmm-3m5g
- NVD CVE-2025-27508
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.