CVE-2026-65627 potatosalad CVE debrief

Who should care

Defenders responsible for Erlang-based systems using the jose library should assess exposure and prioritize patching or mitigation to prevent potential denial-of-service attacks. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, defenders should review the

Why it matters

Defenders should prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks. The issue can be exploited by crafting a JWE token with a small DEFLATE-compressed plaintext, which can lead to a significant increase in memory usage.

• Denial of service due to memory exhaustion
• Potential for significant increase in node memory usage

Technical summary

The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. This can lead to a significant increase in memory usage, potentially causing a denial of service. The issue can be exploited by crafting a JWE token with a small DEFLATE-compressed plaintext, which can lead to a significant increase in memory usage.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch jose to version 1.11.13 or later
• Implement input validation and sanitization for JWE tokens
• Monitor node memory usage and implement limits
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by improper handling of highly compressed data in the jose_jwe_zip:uncompress/2 function, which can lead to a significant increase in memory usage. The issue can be exploited by crafting a JWE token with a small DEFLATE-compressed plaintext.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.