EEF-CVE-2026-65627

See a problem?
Please try reporting it to the source first.

Source

https://cna.erlef.org/osv/EEF-CVE-2026-65627.html

Import Source

https://cna.erlef.org/osv/EEF-CVE-2026-65627.json

JSON Data

https://api.osv.dev/v1/vulns/EEF-CVE-2026-65627

Aliases

CVE-2026-65627
GHSA-wfpv-qxp8-x5gm

Published

2026-10-26T19:53:16Z

Modified

2026-10-26T20:11:07Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

Details

Summary

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.

The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.

Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.

This issue affects jose: from 1.0.0 before 1.11.13.

Workarounds

Reject JWE tokens that carry a zip header before passing them to jose_jwe:block_decrypt/2. DEFLATE compression is rarely used in legitimate JWE traffic, so untrusted tokens whose protected header contains zip: DEF can be inspected and filtered out before decryption.

Database specific

{
    "capec_ids":  [
        "CAPEC-130"
    ],
    "cpe_ids":  [
        "cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids":  [
        "CWE-409"
    ]
}

References

Credits

- Peter Ullrich - REPORTER
- Andrew Bennett - REMEDIATION_DEVELOPER
- Jonatan Männchen / EEF - ANALYST

Affected packages

Hex / jose

Package

Name: jose
Purl: pkg:hex/jose

Affected ranges

Type: SEMVER
Events: Introduced

1.0.0

Fixed

1.11.13

Affected versions

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.1.3

1.2.0

1.3.0

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.5.2

1.6.0

1.6.1

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

1.7.9

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.9.0

1.10.0

1.10.1

1.11.0

1.11.1

1.11.2

1.11.4

1.11.5

1.11.6

1.11.7

1.11.8

1.11.9

1.11.10

1.11.11

1.11.12

Database specific

source

"https://cna.erlef.org/osv/EEF-CVE-2026-65627.json"

Git / github.com/potatosalad/erlang-jose