---
id: "CVE-2026-65627"
kind: "vulnerability"
aliases: ["CVE-2026-65627"]
title: "erlang-jose: small crafted JWE token exhausts memory via decompression"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "erlang", "jose", "jwe", "package", "self-hosted"]
not_affected_if: ["jwe-not-used", "trusted-token-sources"]
published_at: "2026-10-26T20:17:58+00:00"
first_seen_at: "2026-10-26T20:50:17+00:00"
updated_at: "2026-10-26T20:51:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65627", "first_seen_at": "2026-10-26T20:50:17+00:00"}]
---

# erlang-jose: small crafted JWE token exhausts memory via decompression

The jose Erlang library decompresses the zip DEF payload of a JWE token without any output size or ratio limit, so a few-kilobyte token can inflate to gigabytes during decryption. An attacker only needs the recipient's public key to craft one, and a single token can crash the BEAM node and deny service to all users.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the locked version of `jose` (erlang-jose, or JOSE.JWE in Elixir) in `rebar.lock`, `mix.lock` or `deps` and see whether it is below `1.11.13`
- Search the codebase for JWE decryption (`jose_jwe:block_decrypt`, `JOSE.JWE.block_decrypt`) to see whether the app accepts tokens from outside

## Fix

- Upgrade erlang-jose (jose) to `1.11.13` or later
- Until upgraded, reject JWE tokens that carry the `zip: DEF` header before decryption

## Timeline

- 2026-10-26T20:50:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65627

## From the sources

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.

The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.

Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.

This issue affects jose: from 1.0.0 before 1.11.13.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_