CVE-2026-65631 potatosalad CVE debrief

Who should care

Defenders responsible for erlang-jose library usage in applications should assess exposure and prioritize patching vulnerable versions to prevent denial-of-service attacks. This includes operators, security teams, and vulnerability management teams who need to review and update affected applications to ensure secure jose library usage. Additionally, defenders should verify affected scope and remediation from official sources and monitor for suspicious and

Why it matters

CVE-2026-65631 is a denial-of-service vulnerability in erlang-jose that can be exploited by unauthenticated remote attackers. Defenders should prioritize patching vulnerable versions and implement compensating controls if patching is not possible.

• Denial-of-service attacks can be launched without authentication or valid RSA keys
• CPU-exhaustion can be caused by submitting crafted RSA JSON Web Keys
• Patching vulnerable erlang-jose versions can prevent denial-of-service attacks
• Defenders should verify affected scope and remediation from official sources

Technical summary

The vulnerability is caused by inefficient algorithmic complexity in erlang-jose, allowing an unauthenticated remote attacker to cause CPU-exhaustion by submitting a crafted RSA JSON Web Key. The issue arises when an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 API. This leads to a potential denial of service due to CPU-exhaustion. The vulnerability affects jose versions from 1.7.7 before 1.11.13 and can be mitigated by patching vulnerable versions or implementing compensating controls.

Defensive priority

Defenders should prioritize patching vulnerable erlang-jose versions, as an unauthenticated remote attacker can cause a denial-of-service by submitting a crafted RSA JSON Web Key.

Recommended defensive actions

• Patch vulnerable erlang-jose versions to prevent denial-of-service attacks
• Review and update affected applications to ensure secure jose library usage
• Monitor for suspicious activity and implement compensating controls if patching is not possible
• Verify affected scope and remediation from official sources
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability. Additional details are available from source references, including CNA Erlef and GitHub commits. The vulnerability has been reported in jose versions from 1.7.7 before 1.11.13. The Erlang and Elixir wrappers are also affected. No additional information is available on the number of affected deployments or specific exploits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.