jose (Hex)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.11.13 or later clears every advisory below that has a fix.

Upgrade commands

mix

{:jose, "~> 1.11.13"} # then: mix deps.update jose

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
EEF-CVE-2026-65630 Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose	Not rated yet EPSS 0.14%	`>= 1.10.0, < 1.11.13`	`1.11.13`
EEF-CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability	Not rated yet EPSS 0.09%	`>= 1.0.0, < 1.11.13`	`1.11.13`
EEF-CVE-2026-65631 erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service	Not rated yet EPSS 0.24%	`>= 1.7.7, < 1.11.13`	`1.11.13`
EEF-CVE-2026-65629 Weak PBKDF2 parameters for password-encrypted private-key export in jose	Not rated yet EPSS 0.06%	`>= 1.10.0, < 1.11.13`	`1.11.13`
EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types	Not rated yet EPSS 0.14%	`>= 1.5.0, < 1.11.13`	`1.11.13`
EEF-CVE-2026-65627 Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2	Not rated yet EPSS 0.25%	`>= 1.0.0, < 1.11.13`	`1.11.13`
EEF-CVE-2026-65626 Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose	Not rated yet EPSS 0.09%	`>= 1.3.0, < 1.11.13`	`1.11.13`
EEF-CVE-2026-65625 Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose	Not rated yet EPSS 0.11%	`>= 1.2.0, < 1.11.13`	`1.11.13`
GHSA-9mg4-v392-8j68 erlang-jose vulnerable to denial of service via large p2c value	Medium EPSS 0.89%	`< 1.11.7`	`1.11.7`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor