Read the docs
TI-2026-80573 Aliases CVE-2026-65626

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

Priority LOW 25CWE-203Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-203.

Summary

The jose Erlang library, from 1.3.0 before 1.11.13, implements RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module as a Bleichenbacher padding oracle (CWE-203). Decryption returns a distinct result for valid and invalid PKCS#1 v1.5 padding and applies no implicit-rejection countermeasure, while the raw modular exponentiation keeps the check visible through timing. An unauthenticated attacker who knows only the public RSA key and can submit ciphertexts to a decryption endpoint, such as one that unwraps RSA1_5 JWE keys, can recover intercepted plaintext through roughly 10^4 to 10^6 adaptive queries.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator) and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implementation applies no implicit-rejection countermeasure (RFC 8017 §7.2.2): it does not substitute a deterministic pseudo-random plaintext on a padding failure, so a one-bit padding-conformance signal leaks to the caller. Because the underlying modular exponentiation in dp/2 is a raw, non-blinded crypto:mod_pow/3, the padding check also stays distinguishable by timing even when an application normalizes every failure to a single error value. An unauthenticated attacker who knows only the public RSA key and can submit ciphertexts to a decryption endpoint that unwraps RSA1_5 JWE keys (or otherwise calls decrypt_private/3 with rsa_pkcs1_padding) can use this oracle to recover the plaintext of intercepted ciphertexts, such as content-encryption keys and thus the protected message, or to forge signatures, through roughly 10^4 to 10^6 adaptive chosen-ciphertext queries. This issue affects jose: from 1.3.0 before 1.11.13.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00092 0th percentileScored 2026-11-07
Fix Fixed jose (potatosalad): 1.11.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
potatosaladjose1.3.0 to before 1.11.131.11.13Patch availableCNA
  • jose Vendorpotatosalad Affected 1.3.0 to before 1.11.13 Fixed in 1.11.13 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*——potatosalad
  • cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* Versions — — ·potatosalad

Remediation

Update potatosalad jose to version 1.11.13, which is the fixed version. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA jose (potatosalad) Fixed in 1.11.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    potatosalad jose 1.11.13

    8 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-80576 Weak key derivation in jose password-protected key exportPriority HIGH 68
    • TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulusPriority MEDIUM 64
    • TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokensPriority MEDIUM 64
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-65626
  2. 2026-10-27 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

  • TI-2026-80576 Weak key derivation in jose password-protected key export CVSS 4.0HIGH 7.4
  • TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulus CVSS 4.0MEDIUM 6.9
  • TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokens CVSS 4.0MEDIUM 6.9
  • TI-2026-80577 Timing side channel in pure-Erlang X25519 leaks private keys in jose CVSS 4.0MEDIUM 5.9
  • TI-2026-80575 Unbounded recursion in jose JWK shared secret derivation causes DoS CVSS 4.0MEDIUM 5.9
  • TI-2026-80579 ECDSA signature length is not validated in jose, allowing signature malleability CVSS 4.0MEDIUM 5.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences