TI-2026-80572 Aliases CVE-2026-65625

Truncated AES-GCM authentication tags allow forgery in jose

LOW 25CWE-354Published 2026-10-26 · Updated 2026-11-02

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The jose package from 1.2.0 before 1.11.13 derives its verified AES-GCM authentication tag length from the attacker-supplied tag (CWE-354). An attacker who controls a JWE token can truncate the tag to as few as 8 bits, so forged ciphertext is accepted within 256 attempts without the key. The flaw is in the pure-Erlang fallback used when no native crypto NIF provides AES-GCM.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds. This issue affects jose: from 1.2.0 before 1.11.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00115 1st percentileScored 2026-11-07

Fix Fixed jose (potatosalad): 1.11.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
potatosalad	jose	1.2.0 to before 1.11.13	1.11.13	Patch available	CNA

jose Vendorpotatosalad Affected 1.2.0 to before 1.11.13 Fixed in 1.11.13 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:potatosalad:jose::::::::	—	—	potatosalad

cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* Versions — — ·potatosalad

Remediation

Upgrade jose to version 1.11.13, the fixed version listed for the potatosalad jose package.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA jose (potatosalad) Fixed in 1.11.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-26
potatosalad jose 1.11.13
8 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-80576 Weak key derivation in jose password-protected key exportPriority HIGH 68
- TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulusPriority MEDIUM 64
- TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokensPriority MEDIUM 64
Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-26 Threatist record created from CVE-2026-65625
2026-10-27 Priority changed: MEDIUM → LOW
2026-11-02 CISA SSVC decision points changed
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Patch 1

Fix commit 3fa1f8e in potatosalad/erlang-jose

Advisory 1

https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6

Other 3

TI-2026-80576 Weak key derivation in jose password-protected key export CVSS 4.0HIGH 7.4
TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulus CVSS 4.0MEDIUM 6.9
TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokens CVSS 4.0MEDIUM 6.9
TI-2026-80577 Timing side channel in pure-Erlang X25519 leaks private keys in jose CVSS 4.0MEDIUM 5.9
TI-2026-80575 Unbounded recursion in jose JWK shared secret derivation causes DoS CVSS 4.0MEDIUM 5.9
TI-2026-80579 ECDSA signature length is not validated in jose, allowing signature malleability CVSS 4.0MEDIUM 5.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences