{"id":"UBUNTU-CVE-2026-65627","details":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call. Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users. This issue affects jose: from 1.0.0 before 1.11.13.","modified":"2026-10-28T20:17:48.435403615Z","published":"2026-10-26T20:17:00Z","upstream":["CVE-2026-65627"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-65627"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-65627"},{"type":"REPORT","url":"https://cna.erlef.org/cves/cve-2026-65627.html"},{"type":"REPORT","url":"https://github.com"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429"},{"type":"REPORT","url":"https://github.com/potatosalad/erlang-jose/security/advisories/ghsa-wfpv-qxp8-x5gm"},{"type":"REPORT","url":"https://hex.pm/packages/jose"},{"type":"REPORT","url":"https://repo.hex.pm"},{"type":"REPORT","url":"https://github.com/cveproject/cvelistv5/tree/main/cves/2026/65xxx/cve-2026-65627.json"},{"type":"REPORT","url":"https://nvd.nist.gov/vuln/detail/cve-2026-65627"},{"type":"REPORT","url":"https://osv.dev/vulnerability/eef-cve-2026-65627"}],"affected":[{"package":{"name":"jose","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10-2","10-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"jose","binary_version":"10-2build1"},{"binary_name":"libjose0","binary_version":"10-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65627.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10-2build2"],"ecosystem_specific":{"binaries":[{"binary_name":"jose","binary_version":"10-2build2"},{"binary_name":"libjose0","binary_version":"10-2build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65627.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10-3","11-2"],"ecosystem_specific":{"binaries":[{"binary_version":"11-2","binary_name":"jose"},{"binary_name":"libjose0","binary_version":"11-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65627.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11-2","11-3","11-3build1","11-3build2","13-1"],"ecosystem_specific":{"binaries":[{"binary_version":"13-1","binary_name":"jose"},{"binary_name":"libjose0","binary_version":"13-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65627.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/jose?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14-2build1","14-2build2"],"ecosystem_specific":{"binaries":[{"binary_version":"14-2build2","binary_name":"jose"},{"binary_version":"14-2build2","binary_name":"libjose0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65627.json"}},{"package":{"name":"jose","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/jose?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"jose","binary_version":"14-2build1"},{"binary_version":"14-2build1","binary_name":"libjose0"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-65627.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}