{"id":"UBUNTU-CVE-2026-65625","details":"The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds. This issue affects jose: from 1.2.0 before 1.11.13.","modified":"2026-10-28T20:17:34.857348214Z","published":"2026-10-26T20:17:00Z","upstream":["CVE-2026-65625"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-65625"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-65625"},{"type":"REPORT","url":"https://cna.erlef.org/cves/cve-2026-65625.html"},{"type":"REPORT","url":"https://github.com"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose/commit/3fa1f8e3efda0da5ce6f4c9984789f979dc02740"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose/commit/8848b172575fb7d7e1e2977e8ae0a21678d2157a"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose/security/advisories/ghsa-6gxw-6f7r-cjr6"},{"type":"REPORT","url":"https://hex.pm/packages/jose"},{"type":"REPORT","url":"https://repo.hex.pm"},{"type":"REPORT","url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/65xxx/cve-2026-65625.json"},{"type":"REPORT","url":"https://nvd.nist.gov/vuln/detail/cve-2026-65625"},{"type":"REPORT","url":"https://osv.dev/vulnerability/eef-cve-2026-65625"}],"affected":[{"package":{"name":"jose","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10-2","10-2build1"],"ecosystem_specific":{"binaries":[{"binary_version":"10-2build1","binary_name":"jose"},{"binary_name":"libjose0","binary_version":"10-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65625.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10-2build2"],"ecosystem_specific":{"binaries":[{"binary_name":"jose","binary_version":"10-2build2"},{"binary_name":"libjose0","binary_version":"10-2build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65625.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10-3","11-2"],"ecosystem_specific":{"binaries":[{"binary_name":"jose","binary_version":"11-2"},{"binary_name":"libjose0","binary_version":"11-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65625.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11-2","11-3","11-3build1","11-3build2","13-1"],"ecosystem_specific":{"binaries":[{"binary_name":"jose","binary_version":"13-1"},{"binary_name":"libjose0","binary_version":"13-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65625.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/jose?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14-2build1","14-2build2"],"ecosystem_specific":{"binaries":[{"binary_name":"jose","binary_version":"14-2build2"},{"binary_name":"libjose0","binary_version":"14-2build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65625.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14-2build1"],"ecosystem_specific":{"binaries":[{"binary_version":"14-2build1","binary_name":"jose"},{"binary_version":"14-2build1","binary_name":"libjose0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65625.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}