{"answers":{"affected":"1 open source package ship an affected version, including jose.","exploited":"There is no known exploitation of CVE-2026-65627 in the wild and no public exploit code.","fix":"Upgrade jose to 1.11.13 or later.","what":"CVE-2026-65627 is a medium-severity vulnerability in potatosalad jose, published on 26 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-65627 and fix it if it is affected.\n\nWhat it is: CVE-2026-65627 is a medium-severity vulnerability in potatosalad jose, published on 26 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-65627 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- jose (Hex): affected from 1.0.0; fixed in 1.11.13\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-65627/ (Markdown: https://insights.sbomify.com/CVE-2026-65627/index.md)","id":"CVE-2026-65627","markdown":"https://insights.sbomify.com/CVE-2026-65627/index.md","name":"CVE-2026-65627","record":{"aliases":["AZL-111152","DEBIAN-CVE-2026-65627","EEF-CVE-2026-65627","GHSA-wfpv-qxp8-x5gm","UBUNTU-CVE-2026-65627"],"analysis":null,"analysis_generated_by":null,"assigner":"EEF","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-409","name":"Improper Handling of Highly Compressed Data (Data Amplification)"}],"description":"Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.\n\nThe jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.\n\nDecompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.\n\nThis issue affects jose: from 1.0.0 before 1.11.13.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2","id":"CVE-2026-65627","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":5,"next":{"headline":"Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types","id":"CVE-2026-65628"},"packages":[{"ecosystem":"Hex","fixed":["1.11.13"],"introduced":["1.0.0"],"last_affected":[],"package":"jose","purl":"pkg:hex/jose","source":"EEF-CVE-2026-65627"}],"prev":{"headline":"Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose","id":"CVE-2026-65626"},"products":["jose"],"published":"2026-10-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-26","vendors":["potatosalad"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-65627/"}