CVE-2026-65627 Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-65627?
CVE-2026-65627 is a medium-severity vulnerability in potatosalad jose, published on 26 Oct 2026.
Official description
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.
The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.
Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.
This issue affects jose: from 1.0.0 before 1.11.13.
Weakness: CWE-409
Which versions are affected by CVE-2026-65627?
1 open source package ship an affected version, including jose.
| Package | Affected | Fixed in |
|---|---|---|
jose Hex | From 1.0.0 | 1.11.13 |
How do I fix CVE-2026-65627?
Upgrade jose to 1.11.13 or later.
Is CVE-2026-65627 being exploited?
There is no known exploitation of CVE-2026-65627 in the wild and no public exploit code.
Sources
Also known as AZL-111152, DEBIAN-CVE-2026-65627, EEF-CVE-2026-65627, GHSA-wfpv-qxp8-x5gm, UBUNTU-CVE-2026-65627.