Live › vulnerability › CVE-2026-65629
Go to dashboardWhen jose exports a password-encrypted private key, it hardcodes PBKDF2-HMAC-SHA256 with only 2048 iterations and an 8-byte salt, far below current guidance. An attacker who obtains an exported key blob can crack the export password offline and recover the full private key.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Applications that use the jose Erlang/Elixir library at versions from before and that export private keys encrypted with a password. Exposure requires that an exported blob leaks from a backup, repository, storage bucket or log. Projects that only verify tokens or never export password-protected keys can skip it.
1.10.01.11.13No product ranges from the sources yet.
rebar.lock or mix.lock) and see whether it falls in 1.10.0 to before 1.11.13jose_jwk:to_der/2 or JOSE.JWK.to_der/2 with a password1.11.13 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.
When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.
Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.
This issue affects jose: from 1.10.0 before 1.11.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-65629")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.