CVE-2026-65625
Description
A flaw was found in jose. In environments where the pure-Erlang fallback is used for Advanced Encryption Standard Galois/Counter Mode (AES-GCM) decryption, the software determines the number of verification bits directly from the user-provided authentication tag rather than enforcing a standard length. A remote attacker can exploit this by submitting a JSON Web Encryption (JWE) token with a truncated authentication tag, significantly reducing the effort required to forge valid encrypted messages. This flaw allows an attacker to bypass cryptographic integrity checks without knowledge of the secret key, or cause a Denial of Service (DoS) by crashing the decryption process with an oversized tag.
Statement
This vulnerability is rated as Moderate impact because successful integrity bypass and denial-of-service conditions require an uncommon deployment environment where native cryptographic acceleration is absent. In standard Red Hat environments, Erlang runtimes are built with native OpenSSL-backed crypto NIF support, which handles AES-GCM operations and avoids the affected pure-Erlang fallback routine. Consequently, systems operating under standard enterprise configurations are not exposed to this flaw, restricting the risk to specialized setups lacking native cryptographic libraries.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Modify Application Data; Other
Integrity checks usually use a secret key that helps authenticate the data origin. Skipping integrity checking generally opens up the possibility that new data from an invalid source can be injected.
Integrity,Other
Technical Impact: Other
Data that is parsed and used may be corrupted.
Non-Repudiation,Other
Technical Impact: Hide Activities; Other
Without a checksum check, it is impossible to determine if any changes have been made to the data after it was sent.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
