{"id":"AZL-112187","summary":"CVE-2026-65625 affecting package rabbitmq-server 3.13.7-10","details":"The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds.\n\nThis issue affects jose: from 1.2.0 before 1.11.13.","modified":"2026-11-01T14:17:38.203986449Z","published":"2026-10-26T20:17:57Z","upstream":["CVE-2026-65625"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65625"}],"affected":[{"package":{"name":"rabbitmq-server","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/rabbitmq-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.13.7-10"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112187.json"}}],"schema_version":"1.9.2"}