TI-2026-80575 Aliases CVE-2026-65628

Unbounded recursion in jose JWK shared secret derivation causes DoS

MEDIUM 60CWE-674Published 2026-10-26 · Updated 2026-11-02

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

The jose library, from 1.5.0 before 1.11.13, fails in JOSE.JWK.shared_secret/2 when the two JWKs have different key types. The fallback clause calls itself with unchanged arguments, causing unbounded recursion (CWE-674) that never returns. An attacker who supplies a crafted JWK as a peer key to an application that derives shared secrets without checking key types can pin a scheduler at 100% CPU, and repeated requests exhaust the schedulers.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shared_secret(from(YourJWK), from(MyJWK)). Because from/1 returns an already-parsed jose_jwk record unchanged, passing two JWKs whose key types differ (for example an EC key and an RSA key) makes the fallback clause re-enter with identical arguments, producing an unbounded tail-recursive loop that never returns and never crashes. An application that derives a shared secret from an externally supplied peer public key without first checking that the peer key's type and curve match its own key can be driven into this loop by an attacker-controlled JWK, pinning an Erlang scheduler at 100% CPU. Repeated requests exhaust the available schedulers, resulting in a denial of service. This issue affects jose: from 1.5.0 before 1.11.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00136 3rd percentileScored 2026-11-07

Fix Fixed jose (potatosalad): 1.11.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
potatosalad	jose	1.5.0 to before 1.11.13	1.11.13	Patch available	CNA

jose Vendorpotatosalad Affected 1.5.0 to before 1.11.13 Fixed in 1.11.13 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:potatosalad:jose::::::::	—	—	potatosalad

cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* Versions — — ·potatosalad

Remediation

Upgrade jose to version 1.11.13, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA jose (potatosalad) Fixed in 1.11.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-26
potatosalad jose 1.11.13
8 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-80576 Weak key derivation in jose password-protected key exportPriority HIGH 68
- TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulusPriority MEDIUM 64
- TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokensPriority MEDIUM 64
Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-26 Threatist record created from CVE-2026-65628
2026-10-27 Priority changed: MEDIUM → LOW
2026-11-02 CISA SSVC decision points changed
2026-11-02 Priority changed: LOW → MEDIUM
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Patch 1

Fix commit 26182a7 in potatosalad/erlang-jose

Advisory 1

https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-fpj2-9h59-32pp

Other 3

TI-2026-80576 Weak key derivation in jose password-protected key export CVSS 4.0HIGH 7.4
TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulus CVSS 4.0MEDIUM 6.9
TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokens CVSS 4.0MEDIUM 6.9
TI-2026-80577 Timing side channel in pure-Erlang X25519 leaks private keys in jose CVSS 4.0MEDIUM 5.9
TI-2026-80579 ECDSA signature length is not validated in jose, allowing signature malleability CVSS 4.0MEDIUM 5.1
TI-2026-80573 Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose CVSS 4.0MEDIUM 5.9

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences