CVE-2026-65628
Description
A flaw was found in jose. This flaw allows an attacker to cause a Denial of Service (DoS) by triggering an infinite loop during cryptographic key derivation. When deriving a shared secret, passing two JSON Web Keys (JWKs) with mismatched key types causes the shared_secret function to enter unbounded recursion. A remote attacker can submit a crafted key to an application that lacks key validation, exhausting CPU resources and rendering the service unresponsive.
Statement
This vulnerability is rated as having an Important severity because unauthenticated remote attackers can exhaust system CPU resources by submitting mismatched cryptographic public keys, causing unbounded loop cycles on application worker schedulers. Applications are susceptible if they process externally provided JSON Web Keys during key exchange routines without enforcing matching key formats beforehand. Because repeated exploitation can fully degrade service availability without requiring elevated privileges, the issue poses a substantial risk to network services handling untrusted key derivation requests.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
