CVE-2026-65627
Description
A flaw was found in jose. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) through memory exhaustion. When processing JSON Web Encryption (JWE) tokens that use compression, the library decompresses the payload without enforcing limits on the output size or expansion ratio. An attacker can exploit this issue by sending a small, crafted token, causing the application to consume excessive memory and crash.
Statement
A decompression bomb vulnerability was discovered in the Erlang and Elixir jose library when handling JSON Web Encryption (JWE) tokens with compression enabled (DEF). The library uncompresses ciphertext using zlib:inflate/2 without bounding the output size or inflation ratio. An unauthenticated remote attacker can exploit this flaw by submitting a small, highly compressed crafted JWE token, causing uncontrolled memory allocation that exhausts system resources and crashes the BEAM virtual machine, resulting in a denial of service.
Mitigation
Reject JWE tokens carrying the "zip": "DEF" header at the application gateway or API perimeter before decryption routines are executed.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce bounded decompression during JWE block decryption in jose: upgrade to jose 1.11.13 (or the corresponding fixed Red Hat builds), which perform incremental decompression via zlib:safeInflate/2 and abort with a badarg error if output exceeds a configurable ceiling, closing all 2 injection vectors (crafted JWE token with zip DEF header, DEFLATE decompression bomb). Until patched, this is a concern on applications decrypting JWE tokens using jose, so reject JWE tokens carrying the zip DEF header at the application gateway or API perimeter before decryption routines are executed. As a compensating measure, monitor cgroup memory pressure events and PSI to detect rapid memory spikes and out-of-memory pressure caused by decompression bombs. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded decompression defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
