Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

jose

9 known vulnerabilities (1 high, 8 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 1 high, 8 medium
Registry
Hex

Advisories 9

  • CVE-2026-65630Medium 5.9

    Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

    Affected: from 1.10.0, fixed in 1.11.13.

  • CVE-2026-65632Medium 5.1

    ECDSA signature length is not validated in jose, allowing signature malleability

    Affected: from 1.0.0, fixed in 1.11.13.

  • CVE-2026-65631Medium 6.9

    erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

    Affected: from 1.7.7, fixed in 1.11.13; from 1.7.7, fixed in 1.11.13.

  • Weak PBKDF2 parameters for password-encrypted private-key export in jose

    Affected: from 1.10.0, fixed in 1.11.13.

  • CVE-2026-65628Medium 5.9

    Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

    Affected: from 1.5.0, fixed in 1.11.13.

  • CVE-2026-65627Medium 6.9

    Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

    Affected: from 1.0.0, fixed in 1.11.13.

  • CVE-2026-65626Medium 5.9

    Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

    Affected: from 1.3.0, fixed in 1.11.13.

  • CVE-2026-65625Medium 5.9

    Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

    Affected: from 1.2.0, fixed in 1.11.13.

  • CVE-2023-50966Medium 5.3

    erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c…

    Affected: fixed in 1.11.7.