JO
Product
jose
8
CVEs
0
On KEV
7.4
Max CVSS
8
New 30D
Severity mix
Critical 0High 1Medium 7Low 0
Watch
Add jose to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-65629 New | 7.4 | Oct 26 | Weak PBKDF2 parameters for password-encrypted private-key export in jose Affected: 1.10.0 before 1.11.13; 85fddd89ee56b6f9c19eff7d9cfffeef62c330b9 before 461b261902531ca016190e780bb70862d561a7e0 |
| CVE-2026-65631 New | 6.9 | Oct 26 | erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service Affected: 1.7.7 before 1.11.13; d19e1ba68d88c68d29aa942be2573a22dbafca1f before bfd336c0062bff93e65d08c22361897e96afd956 |
| CVE-2026-65627 New | 6.9 | Oct 26 | Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 Affected: 1.0.0 before 1.11.13; a7746ecd4950f85a393136e449a91dac62b5c429 before 857eb8e7f2d33e2c9ca2189e77226561cacaf2ad |
| CVE-2026-65630 New | 5.9 | Oct 26 | Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose Affected: 1.10.0 before 1.11.13; 8e532095de114ef4bf88a9ec5d651fa251a972b3 before 3670f873c274bba86fb7f5ee5727a7efa1322b79 |
| CVE-2026-65628 New | 5.9 | Oct 26 | Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types Affected: 1.5.0 before 1.11.13; 7b80b9f55b9898e1a6901ce136061b241b021d7c before 26182a7de63b91550035d3f08741f7d17f1f675a |
| CVE-2026-65626 New | 5.9 | Oct 26 | Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose Affected: 1.3.0 before 1.11.13; 853c5d4c4c0bd2a7ecb055b237f4284184e176c8 before 0eac8cef9aaa48fb6846f4e47a0002dc4a73966d |
| CVE-2026-65625 New | 5.9 | Oct 26 | Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose Affected: 1.2.0 before 1.11.13; 8848b172575fb7d7e1e2977e8ae0a21678d2157a before 3fa1f8e3efda0da5ce6f4c9984789f979dc02740 |
| CVE-2026-65632 New | 5.1 | Oct 26 | ECDSA signature length is not validated in jose, allowing signature malleability Affected: 1.0.0 before 1.11.13; a7746ecd4950f85a393136e449a91dac62b5c429 before 72ce1866622b9329347dc52a94173ac0317bc9cf |
Showing 8