---
id: "CVE-2026-65626"
kind: "vulnerability"
aliases: ["CVE-2026-65626"]
title: "jose (Erlang): RSA1_5 decryption leaks padding validity, enabling Bleichenbacher attack"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "erlang", "jose", "jwe", "package"]
not_affected_if: ["jose-1.11.13-or-later", "no-rsa1_5-decryption", "oaep-only"]
published_at: "2026-10-26T20:17:58+00:00"
first_seen_at: "2026-10-26T20:50:17+00:00"
updated_at: "2026-10-26T20:51:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65626", "first_seen_at": "2026-10-26T20:50:17+00:00"}]
---

# jose (Erlang): RSA1_5 decryption leaks padding validity, enabling Bleichenbacher attack

The Erlang jose library's pure-Erlang RSAES-PKCS1-v1_5 decryption acts as a Bleichenbacher padding oracle, with no implicit rejection and non-blinded modular exponentiation. An attacker who can submit ciphertexts to an endpoint that unwraps RSA1_5 keys can recover plaintexts such as content-encryption keys in roughly 10^4 to 10^6 queries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the jose version in `rebar.lock` or `mix.lock` (Erlang/Elixir projects), e.g. `grep jose rebar.lock mix.lock`
- Search application code for RSA1_5 JWE decryption or `decrypt_private/3` with `rsa_pkcs1_padding`

## Fix

- Upgrade jose to `1.11.13` or later
- Where possible, stop accepting RSA1_5 key wrapping and move to RSA-OAEP or ECDH-ES

## Timeline

- 2026-10-26T20:50:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65626

## From the sources

The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator) and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implementation applies no implicit-rejection countermeasure (RFC 8017 §7.2.2): it does not substitute a deterministic pseudo-random plaintext on a padding failure, so a one-bit padding-conformance signal leaks to the caller. Because the underlying modular exponentiation in dp/2 is a raw, non-blinded crypto:mod_pow/3, the padding check also stays distinguishable by timing even when an application normalizes every failure to a single error value.

An unauthenticated attacker who knows only the public RSA key and can submit ciphertexts to a decryption endpoint that unwraps RSA1_5 JWE keys (or otherwise calls decrypt_private/3 with rsa_pkcs1_padding) can use this oracle to recover the plaintext of intercepted ciphertexts, such as content-encryption keys and thus the protected message, or to forge signatures, through roughly 10^4 to 10^6 adaptive chosen-ciphertext queries.

This issue affects jose: from 1.3.0 before 1.11.13.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_