These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The jose library has a signature malleability issue affecting ECDSA JWS signatures of non-canonical lengths. This CVE has a MEDIUM CVSS score of 5.1. The issue allows an attacker with a valid token to create longer signatures that verify against the same key, potentially defeating security controls like token revocation by hash or replay caches. The vulnerability arises from the library's acceptance of EC [truncated]
CVE-2026-65631 is a denial-of-service vulnerability in erlang-jose, caused by inefficient algorithmic complexity. An unauthenticated remote attacker can submit a crafted RSA JSON Web Key to cause CPU-exhaustion. This issue affects jose versions from 1.7.7 before 1.11.13. The vulnerability is triggered when an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_ma [truncated]
A timing side-channel vulnerability in the jose library allows recovery of a long-term X25519 private key through measurement of decryption timing for attacker-supplied ECDH-ES (JWE) messages. This issue affects jose versions from 1.10.0 before 1.11.13. The vulnerability is reachable from the public API, particularly when services decrypt attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 ke [truncated]
CVE-2026-65629 is a high-severity vulnerability in the jose library, which allows an attacker to recover a private key through an offline password-cracking attack if they obtain a password-encrypted private-key export. The vulnerability arises from the use of a password hash with insufficient computational effort, specifically with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration [truncated]
CVE-2026-65628 is a denial-of-service vulnerability in the jose package for Elixir. An attacker can cause an unbounded loop by supplying a crafted JWK, leading to scheduler exhaustion. This issue affects jose versions from 1.5.0 before 1.11.13. Defenders should prioritize verifying and updating jose package versions to prevent potential denial-of-service attacks. Elixir developers and administrators using [truncated]
A vulnerability in the jose (erlang-jose) library allows a remote attacker to exhaust a node's memory with a small crafted JWE token, potentially causing a denial of service. The issue affects jose versions from 1.0.0 before 1.11.13. This vulnerability is caused by improper handling of highly compressed data in the jose_jwe_zip:uncompress/2 function, which can lead to a significant increase in memory usag [truncated]
CVE-2026-65626 is a Bleichenbacher padding oracle vulnerability in the pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module. This issue allows an unauthenticated attacker who knows only the public RSA key to recover the plaintext of intercepted ciphertexts or forge signatures through adaptive chosen-ciphertext queries. The vulnerability affects jose versions from 1.3.0 before 1.11.13.
CVE-2026-65625 is a vulnerability in the pure-Erlang AES-GCM fallback in jose_jwa_aes. The vulnerability allows an attacker to truncate the authentication tag to as little as 8 bits, reducing forgery resistance from 2^-128 to 2^-8. This issue affects jose versions from 1.2.0 before 1.11.13. The vulnerability is caused by the pure-Erlang AES-GCM fallback in jose_jwa_aes deriving the number of verified auth [truncated]
