CVE-2026-65625 Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-65625?
CVE-2026-65625 is a medium-severity vulnerability in potatosalad jose, published on 26 Oct 2026.
Official description
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds.
This issue affects jose: from 1.2.0 before 1.11.13.
Weakness: CWE-354
Which versions are affected by CVE-2026-65625?
1 open source package ship an affected version, including jose.
| Package | Affected | Fixed in |
|---|---|---|
jose Hex | From 1.2.0 | 1.11.13 |
How do I fix CVE-2026-65625?
Upgrade jose to 1.11.13 or later.
Is CVE-2026-65625 being exploited?
There is no known exploitation of CVE-2026-65625 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-65625, EEF-CVE-2026-65625, GHSA-6gxw-6f7r-cjr6, UBUNTU-CVE-2026-65625.