CVE-2026-65626 Affecting erlang-jose package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-ERLANGJOSE-21762089
- published28 Oct 2026
- disclosed26 Oct 2026
Introduced: 26 Oct 2026
NewCVE-2026-65626 (opens in a new tab)How to fix?
There is no fixed version for Echo:latest erlang-jose.
NVD Description
Note: Versions mentioned in the description apply only to the upstream erlang-jose package and not the erlang-jose package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator) and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implementation applies no implicit-rejection countermeasure (RFC 8017 §7.2.2): it does not substitute a deterministic pseudo-random plaintext on a padding failure, so a one-bit padding-conformance signal leaks to the caller. Because the underlying modular exponentiation in dp/2 is a raw, non-blinded crypto:mod_pow/3, the padding check also stays distinguishable by timing even when an application normalizes every failure to a single error value.
An unauthenticated attacker who knows only the public RSA key and can submit ciphertexts to a decryption endpoint that unwraps RSA1_5 JWE keys (or otherwise calls decrypt_private/3 with rsa_pkcs1_padding) can use this oracle to recover the plaintext of intercepted ciphertexts, such as content-encryption keys and thus the protected message, or to forge signatures, through roughly 10^4 to 10^6 adaptive chosen-ciphertext queries.
This issue affects jose: from 1.3.0 before 1.11.13.
References
- https://advisory.echohq.com/cve/CVE-2026-65626
- https://cna.erlef.org/cves/CVE-2026-65626.html
- https://github.com/potatosalad/erlang-jose/commit/0eac8cef9aaa48fb6846f4e47a0002dc4a73966d
- https://github.com/potatosalad/erlang-jose/commit/853c5d4c4c0bd2a7ecb055b237f4284184e176c8
- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-vwvr-f994-6j9j
- https://osv.dev/vulnerability/EEF-CVE-2026-65626