p PatchFirst

CVE-2026-65627

CVE-2026-65627 · Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call. Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users. This issue affects jose: from 1.0.0 before 1.11.13.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • jose

    Versions
    • ≥ 1.0.0, < 1.11.13: Affected (semver)

    Update to 1.11.13

  • jose

    Versions
    • ≥ a7746ecd4950f85a393136e449a91dac62b5c429, < 857eb8e7f2d33e2c9ca2189e77226561cacaf2ad: Affected (git)

    No fix published

  • erlang-jose Debian:12

    Versions
    • 1.11.10-1
    • 1.11.10-1~bpo12+1
    • 1.11.12-1
    • 1.11.12-1.1
    • 1.11.12-2
    • 1.11.12-2~bpo13+1
    • 1.11.12-3
    • 1.11.12-3~bpo13+1
    • 1.11.5-1
    • 1.11.6-1
    • 1.11.6-1~bpo12+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • erlang-jose Debian:13

    Versions
    • 1.11.10-1
    • 1.11.12-1
    • 1.11.12-1.1
    • 1.11.12-2
    • 1.11.12-2~bpo13+1
    • 1.11.12-3
    • 1.11.12-3~bpo13+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • erlang-jose Debian:14

    Versions
    • 1.11.10-1
    • 1.11.12-1
    • 1.11.12-1.1
    • 1.11.12-2
    • 1.11.12-2~bpo13+1
    • 1.11.12-3
    • 1.11.12-3~bpo13+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jose Ubuntu:18.04:LTS

    Versions
    • 10-2
    • 10-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jose Ubuntu:20.04:LTS

    Versions
    • 10-2build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jose Ubuntu:22.04:LTS

    Versions
    • 10-3
    • 11-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jose Ubuntu:24.04:LTS

    Versions
    • 11-2
    • 11-3
    • 11-3build1
    • 11-3build2
    • 13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jose Ubuntu:26.10

    Versions
    • 14-2build1
    • 14-2build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jose Ubuntu:26.04:LTS

    Versions
    • 14-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →