Skip to content
Log inStart free trial

EEF-CVE-2026-65627 CVE-2026-65627 GHSA-wfpv-qxp8-x5gm

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

Not rated yet Hex
Severity
0.0 / 10
Unknown · CVSS 4.0
Exploit chance (EPSS)
0.25%
Chance of exploitation in the next 30 days. Higher than 16.23% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Fix
1.11.13
Upgrade jose to this version or later

Description

Summary

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.

The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.

Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.

This issue affects jose: from 1.0.0 before 1.11.13.

Workarounds

Reject JWE tokens that carry a zip header before passing them to jose_jwe:block_decrypt/2. DEFLATE compression is rarely used in legitimate JWE traffic, so untrusted tokens whose protected header contains zip: DEF can be inspected and filtered out before decryption.

Affected versions

Hex

PackageVulnerableFixed in
jose
>= 1.0.0, < 1.11.13
1.11.13

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

jose Hex → 1.11.13

mix
{:jose, "~> 1.11.13"} # then: mix deps.update jose

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector
Local
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
None
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

Weakness

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
EEF-CVE-2026-65630
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
Not rated yet Also affects jose
EEF-CVE-2026-65632
ECDSA signature length is not validated in jose, allowing signature malleability
Not rated yet Also affects jose
EEF-CVE-2026-65631
erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
Not rated yet Also affects jose
EEF-CVE-2026-65629
Weak PBKDF2 parameters for password-encrypted private-key export in jose
Not rated yet Also affects jose
EEF-CVE-2026-65628
Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
Not rated yet Also affects jose
EEF-CVE-2026-65626
Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
Not rated yet Also affects jose
EEF-CVE-2026-65625
Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
Not rated yet Also affects jose
GHSA-9mg4-v392-8j68
erlang-jose vulnerable to denial of service via large p2c value
Medium Also affects jose

Credits: Andrew Bennett, Jonatan Männchen / EEF, Peter Ullrich

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor