UBUNTU-CVE-2026-65627: Medium severity ubuntu/jose vulnerability
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The josejwezip:uncompress/2 function in src/jwe/josejwezip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call. Decompression runs automatically during decryption through josejwe:blockdecrypt/2 (JOSE.JWE.blockdecrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users. This issue affects jose: from 1.0.0 before 1.11.13.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments that decrypt attacker-supplied JWE tokens are exposed, particularly when they use RSA-OAEP or ECDH-ES key management. An attacker can create a malicious token with only the recipient's public key, without authentication or private key material.
Does exploitation require a large request or valid payload authentication?
No. A small crafted JWE using the zip: DEF header can expand by roughly 1000:1 during decryption, potentially consuming hundreds of megabytes or gigabytes of memory. The decompression occurs before the recipient can inspect or reject the plaintext.
What versions are affected?
The issue affects jose versions from 1.0.0 before 1.11.13.
What is the operational impact of a successful attack?
A single malicious token can exhaust node memory and crash the BEAM, causing denial of service for all users served by that node.