CVE-2026-65632
Description
A flaw was found in jose. When verifying Elliptic Curve Digital Signature Algorithm (ECDSA) signatures, the library does not enforce fixed signature lengths and ignores leading zero bytes. An attacker with a valid token can alter the signature format while keeping it cryptographically valid, causing signature malleability. This can enable an attacker to bypass security controls that rely on token uniqueness, such as token revocation lists, replay protection caches, and deduplication mechanisms.
Statement
This vulnerability is rated as a Moderate impact because it allows an attacker possessing a valid signature to bypass uniqueness checks such as deduplication or replay caches, but cannot be leveraged to forge signatures, alter token claims, or achieve unauthorized privilege elevation. Within Red Hat environments, exposure is restricted to applications using Erlang-based Jose services where token identity is tracked via raw cryptographic hashes rather than verified internal identifiers. Because creating modified signatures requires an attacker to already possess an authorized token, arbitrary data cannot be signed and confidentiality is unaffected.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
