{"id":"CVE-2026-65627","kind":"vulnerability","aliases":["CVE-2026-65627"],"related":[],"title":"erlang-jose: small crafted JWE token exhausts memory via decompression","description":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.\n\nThe jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.\n\nDecompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.\n\nThis issue affects jose: from 1.0.0 before 1.11.13.","summary":"The jose Erlang library decompresses the zip DEF payload of a JWE token without any output size or ratio limit, so a few-kilobyte token can inflate to gigabytes during decryption. An attacker only needs the recipient's public key to craft one, and a single token can crash the BEAM node and deny service to all users.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","erlang","jose","jwe","package","self-hosted"],"not_affected_if":["jwe-not-used","trusted-token-sources"],"how_to_check":"- Check the locked version of `jose` (erlang-jose, or JOSE.JWE in Elixir) in `rebar.lock`, `mix.lock` or `deps` and see whether it is below `1.11.13`\n- Search the codebase for JWE decryption (`jose_jwe:block_decrypt`, `JOSE.JWE.block_decrypt`) to see whether the app accepts tokens from outside","fix":"- Upgrade erlang-jose (jose) to `1.11.13` or later\n- Until upgraded, reject JWE tokens that carry the `zip: DEF` header before decryption","status":"open","published_at":"2026-10-26T20:17:58+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:42+00:00","updated_at":"2026-10-26T20:51:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T20:51:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade erlang-jose (jose) to `1.11.13` or later\n- Until upgraded, reject JWE tokens that carry the `zip: DEF` header before decryption","reach":"internet","title":"erlang-jose: small crafted JWE token exhausts memory via decompression","impact":"medium","summary":"The jose Erlang library decompresses the zip DEF payload of a JWE token without any output size or ratio limit, so a few-kilobyte token can inflate to gigabytes during decryption. An attacker only needs the recipient's public key to craft one, and a single token can crash the BEAM node and deny service to all users.","category":"package","nicknames":[],"who_cares":["erlang","elixir","jose","jwe","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"a small token crashes the node with memory exhaustion","analyst_note":"","how_to_check":"- Check the locked version of `jose` (erlang-jose, or JOSE.JWE in Elixir) in `rebar.lock`, `mix.lock` or `deps` and see whether it is below `1.11.13`\n- Search the codebase for JWE decryption (`jose_jwe:block_decrypt`, `JOSE.JWE.block_decrypt`) to see whether the app accepts tokens from outside","needs_analyst":false,"not_affected_if":["jwe-not-used","trusted-token-sources"],"who_is_affected":"Applications that decrypt JWE tokens with the jose library and accept them from untrusted parties, since the attacker only needs the recipient's public key with RSA-OAEP or ECDH-ES. Services that never decrypt JWE input, or that only handle tokens from trusted sources, are much less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":3678,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65627':14A,17A '1':168C '1.0.0':273C '1.11.13':275C '1000':167C 'affect':270C 'algorithm':220C 'allow':100C 'amplif':92C 'around':166C 'asymmetr':216C 'attack':59B,103C,148C,228C 'attacker-control':147C 'authent':243C 'automat':192C 'beam':77B,262C 'block':198C 'bound':153C 'call':141C,189C 'carri':134C 'common':215C 'compress':89C,128C 'control':149C 'craft':5A,68B,113C,237C 'crash':75B,260C 'cve':12A,15A 'data':90C,91C 'decompress':11A,30B,124C,190C 'decrypt':57B,194C 'decrypt/2':199C,201C 'def':33B,138C 'deflat':127C,163C 'deflate-compress':126C 'deni':80B,263C 'ecdh':225C 'ecdh-':224C 'elixir':18B,203C 'entir':146C 'erlang':2A,19B,28B,98C 'erlang-jos':1A,97C 'es':226C 'exhaust':8A,105C,254C 'few-kilobyt':48B,175C 'function':121C 'gigabyt':55B,185C 'handl':86C 'header':139C 'high':88C,170C 'host':25B 'hundr':181C 'improp':85C 'inflat':53B,160C,179C 'inflate/2':143C 'input':172C 'inspect':208C 'issu':269C 'jose':3A,20B,27B,96C,99C,117C,196C,271C 'jose.jwe.block':200C 'jwe':6A,21B,37B,114C,118C,132C,197C 'key':66B,218C,235C 'key-manag':217C 'kilobyt':50B,177C 'librari':29B 'limit':45B 'manag':219C 'materi':246C 'megabyt':183C 'memori':9A,109C,258C 'need':61B,229C 'node':78B,107C,256C 'oaep':223C 'one':69B 'option':136C 'output':41B,156C 'packag':22B 'payload':34B,212C 'plaintext':129C 'potatosalad':95C 'public':65B,234C 'ratio':44B,161C,165C 'raw':162C 'reach':164C 'recipi':63B,206C,232C 'reject':210C 'remot':102C 'repetit':171C 'requir':248C 'rsa':222C 'rsa-oaep':221C 'run':191C 'secret':245C 'self':24B 'self-host':23B 'servic':81B,264C 'singl':72B,188C,250C 'size':42B,157C 'small':4A,112C,251C 'src/jwe/jose_jwe_zip.erl':123C 'stream':150C 'token':7A,38B,51B,73B,115C,178C,240C,252C 'uncompress/2':120C 'user':84B,267C 'via':10A 'vulner':93C 'without':39B 'zip':32B,119C,137C 'zlib':142C","nicknames":[],"mitigations":[],"who_affected":"Applications that decrypt JWE tokens with the jose library and accept them from untrusted parties, since the attacker only needs the recipient's public key with RSA-OAEP or ECDH-ES. Services that never decrypt JWE input, or that only handle tokens from trusted sources, are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65627","severity":null,"published_at":"2026-10-26T20:17:58+00:00","modified_at":"2026-10-26T20:17:58+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}