CVE-2026-65631
Description
A flaw was found in jose. An unauthenticated remote attacker can exploit this vulnerability to cause a Denial of Service (DoS) by submitting a specially crafted JSON Web Key (JWK). When processing an RSA key that lacks certain mathematical parameters, the library attempts to calculate the missing values through factoring without validating the input. If supplied with an invalid key that cannot be factored, the parsing routine enters an intensive calculation loop that exhausts CPU resources and disrupts service availability.
Statement
This vulnerability is rated as an Important severity because unauthenticated remote attackers can trigger a denial of service without requiring prior system privileges. Systems running applications that parse untrusted cryptographic keys directly from external input are susceptible to severe CPU starvation across worker threads. The flaw does not allow unauthorized data access or modification, limiting the direct impact to application availability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
