CVE-2026-65625 Affecting erlang-jose package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIANUNSTABLE-ERLANGJOSE-21757304
- published28 Oct 2026
- disclosed26 Oct 2026
Introduced: 26 Oct 2026
NewCVE-2026-65625 (opens in a new tab)How to fix?
There is no fixed version for Debian:unstable erlang-jose.
NVD Description
Note: Versions mentioned in the description apply only to the upstream erlang-jose package and not the erlang-jose package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds.
This issue affects jose: from 1.2.0 before 1.11.13.
References
- https://security-tracker.debian.org/tracker/CVE-2026-65625
- https://cna.erlef.org/cves/CVE-2026-65625.html
- https://github.com/potatosalad/erlang-jose/commit/3fa1f8e3efda0da5ce6f4c9984789f979dc02740
- https://github.com/potatosalad/erlang-jose/commit/8848b172575fb7d7e1e2977e8ae0a21678d2157a
- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6
- https://osv.dev/vulnerability/EEF-CVE-2026-65625