---
cve: "CVE-2026-65627"
severity: "MEDIUM"
cvss: 6.9
epss: ""
vendor: "potatosalad"
kev: false
exploited: false
published: "2026-10-26 20:17:58"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-31T20:02:16+01:00"
---

# CVE-2026-65627

> 6.9 MEDIUM · 🧪 PoC

## Beschreibung

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.

The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.

Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.

This issue affects jose: from 1.0.0 before 1.11.13.

## CNA-Record (Kanon, cvelistV5)

- CNA: **EEF**
- State: PUBLISHED
- Stand: 2026-10-26 19:53:16
- CNA-CVSS: **6.9** (`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-409** — Improper Handling of Highly Compressed Data (Data Amplification)
  The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

## Patch verfügbar (OSV)

- 857eb8e7f2d33e2c9ca2189e77226561cacaf2ad (Commit)
- 0f57e002a9bbe2464f5fce6facfe13d83e15ae61 (Commit)

## Referenzen

- <https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-wfpv-qxp8-x5gm>
- <https://cna.erlef.org/cves/CVE-2026-65627.html>
- <https://osv.dev/vulnerability/EEF-CVE-2026-65627>
- <https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429>
- <https://github.com/potatosalad/erlang-jose/commit/857eb8e7f2d33e2c9ca2189e77226561cacaf2ad>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-65627/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_