Read the docs
TI-2026-80578 Aliases CVE-2026-65631

erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulus

Priority MEDIUM 64CWE-407Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-407.

Summary

The erlang-jose library, package jose, from 1.7.7 before 1.11.13 is affected. Parsing an untrusted RSA JSON Web Key whose modulus cannot be factored triggers a search for the missing primes that never succeeds, a case of inefficient algorithmic complexity (CWE-407). An unauthenticated remote attacker can submit a crafted key of a few hundred bytes to consume close to one CPU-second per request, and flooding such requests can saturate every scheduler and deny service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 API (or the Elixir wrappers JOSE.JWK.from_binary/1 and JOSE.JWK.from_map/1), an RSA private key that supplies d, e, and n but omits all Chinese Remainder Theorem parameters (p, q, dp, dq, qi) is routed into convert_sfm_to_crt/1, which tries to recover the missing primes by factoring the modulus. The three integers are read straight from the base64url input and are never validated as a real RSA key. When the modulus cannot be split into two factors (for example, when it is itself prime), the search loop convert_sfm_to_crt_find_p/6 performs a modular exponentiation over the attacker-sized modulus on every iteration and never succeeds. A single request of a few hundred bytes forces close to one CPU-second of work before an internal one-second watchdog kills the worker, and a larger modulus raises the cost further. By flooding such requests an attacker can saturate every scheduler and deny service, without credentials, a valid RSA key, or any special configuration. This issue affects jose: from 1.7.7 before 1.11.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix Fixed jose (potatosalad): 1.11.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
potatosaladjose1.7.7 to before 1.11.131.11.13Patch availableCNA
  • jose Vendorpotatosalad Affected 1.7.7 to before 1.11.13 Fixed in 1.11.13 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*——potatosalad
  • cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* Versions — — ·potatosalad

Remediation

Upgrade potatosalad jose to version 1.11.13 or later, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA jose (potatosalad) Fixed in 1.11.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    potatosalad jose 1.11.13

    8 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-80576 Weak key derivation in jose password-protected key exportPriority HIGH 68
    • TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokensPriority MEDIUM 64
    • TI-2026-80577 Timing side channel in pure-Erlang X25519 leaks private keys in josePriority MEDIUM 60
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-65631
  2. 2026-10-27 Priority changed: MEDIUM → LOW
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: LOW → MEDIUM
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

  • TI-2026-80576 Weak key derivation in jose password-protected key export CVSS 4.0HIGH 7.4
  • TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokens CVSS 4.0MEDIUM 6.9
  • TI-2026-80577 Timing side channel in pure-Erlang X25519 leaks private keys in jose CVSS 4.0MEDIUM 5.9
  • TI-2026-80575 Unbounded recursion in jose JWK shared secret derivation causes DoS CVSS 4.0MEDIUM 5.9
  • TI-2026-80579 ECDSA signature length is not validated in jose, allowing signature malleability CVSS 4.0MEDIUM 5.1
  • TI-2026-80573 Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose CVSS 4.0MEDIUM 5.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences