CVE-2026-65632 (GCVE-0-2026-65632)
Vulnerability from cvelistv5
Published
2026-10-26 19:53
Modified
2026-11-02 21:30
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Summary
The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (split_binary(Signature, byte_size(Signature) div 2)) instead of enforcing the fixed length required by RFC 7518 §3.4, and then decodes each half with crypto:bytes_to_integer/1, which ignores leading zero bytes.
As a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same (r, s) pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying (r, s) values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.
This issue affects jose: from 1.0.0 before 1.11.13.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| potatosalad | jose |
Version: 1.0.0 ≤ cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65632",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T21:30:31.772807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T21:30:52.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"jose_jwk_kty_ec"
],
"packageName": "jose",
"packageURL": "pkg:hex/jose",
"product": "jose",
"programFiles": [
"src/jwk/jose_jwk_kty_ec.erl"
],
"programRoutines": [
{
"name": "jose_jwk_kty_ec:verify/4"
}
],
"repo": "https://github.com/potatosalad/erlang-jose",
"vendor": "potatosalad",
"versions": [
{
"lessThan": "1.11.13",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"jose_jwk_kty_ec"
],
"packageName": "potatosalad/erlang-jose",
"packageURL": "pkg:github/potatosalad/erlang-jose",
"product": "jose",
"programFiles": [
"src/jwk/jose_jwk_kty_ec.erl"
],
"programRoutines": [
{
"name": "jose_jwk_kty_ec:verify/4"
}
],
"repo": "https://github.com/potatosalad/erlang-jose",
"vendor": "potatosalad",
"versions": [
{
"lessThan": "72ce1866622b9329347dc52a94173ac0317bc9cf",
"status": "affected",
"version": "a7746ecd4950f85a393136e449a91dac62b5c429",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11.13",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andrew Bennett"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe \u003ccode\u003ejose\u003c/code\u003e library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, \u003ccode\u003ejose_jwk_kty_ec:verify/4\u003c/code\u003e in \u003ccode\u003esrc/jwk/jose_jwk_kty_ec.erl\u003c/code\u003e splits the raw signature in half by its actual byte length (\u003ccode\u003esplit_binary(Signature, byte_size(Signature) div 2)\u003c/code\u003e) instead of enforcing the fixed length required by RFC 7518 \u00a73.4, and then decodes each half with \u003ccode\u003ecrypto:bytes_to_integer/1\u003c/code\u003e, which ignores leading zero bytes.\u003c/p\u003e\n\u003cp\u003eAs a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same \u003ccode\u003e(r, s)\u003c/code\u003e pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying \u003ccode\u003e(r, s)\u003c/code\u003e values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.\u003c/p\u003e\n\u003cp\u003eThis issue affects jose: from 1.0.0 before 1.11.13.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The `jose` library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, `jose_jwk_kty_ec:verify/4` in `src/jwk/jose_jwk_kty_ec.erl` splits the raw signature in half by its actual byte length (`split_binary(Signature, byte_size(Signature) div 2)`) instead of enforcing the fixed length required by RFC 7518 \u00a73.4, and then decodes each half with `crypto:bytes_to_integer/1`, which ignores leading zero bytes.\n\nAs a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same `(r, s)` pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying `(r, s)` values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.\n\nThis issue affects jose: from 1.0.0 before 1.11.13."
}
],
"value": "The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (split_binary(Signature, byte_size(Signature) div 2)) instead of enforcing the fixed length required by RFC 7518 \u00a73.4, and then decodes each half with crypto:bytes_to_integer/1, which ignores leading zero bytes.\n\nAs a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same (r, s) pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying (r, s) values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.\n\nThis issue affects jose: from 1.0.0 before 1.11.13."
}
],
"impacts": [
{
"capecId": "CAPEC-475",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-475 Signature Spoofing by Improper Validation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:53:56.649Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4"
},
{
"name": "EEF CNA record for CVE-2026-65632",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-65632.html"
},
{
"name": "OSV record EEF-CVE-2026-65632",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-65632"
},
{
"name": "Introducing commit a7746ec in potatosalad/erlang-jose",
"tags": [
"related"
],
"url": "https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429"
},
{
"name": "Fix commit 72ce186 in potatosalad/erlang-jose",
"tags": [
"patch"
],
"url": "https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ECDSA signature length is not validated in jose, allowing signature malleability"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-65632",
"datePublished": "2026-10-26T19:53:56.649Z",
"dateReserved": "2026-07-22T13:58:26.233Z",
"dateUpdated": "2026-11-02T21:30:52.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-65632\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-02T21:30:31.772807Z\"}}}], \"references\": [{\"url\": \"https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-02T21:30:47.855Z\"}}], \"cna\": {\"title\": \"ECDSA signature length is not validated in jose, allowing signature malleability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Andrew Bennett\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-475\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-475 Signature Spoofing by Improper Validation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/potatosalad/erlang-jose\", \"vendor\": \"potatosalad\", \"modules\": [\"jose_jwk_kty_ec\"], \"product\": \"jose\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0\", \"lessThan\": \"1.11.13\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/jose\", \"packageName\": \"jose\", \"programFiles\": [\"src/jwk/jose_jwk_kty_ec.erl\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"jose_jwk_kty_ec:verify/4\"}]}, {\"cpes\": [\"cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/potatosalad/erlang-jose\", \"vendor\": \"potatosalad\", \"modules\": [\"jose_jwk_kty_ec\"], \"product\": \"jose\", \"versions\": [{\"status\": \"affected\", \"version\": \"a7746ecd4950f85a393136e449a91dac62b5c429\", \"lessThan\": \"72ce1866622b9329347dc52a94173ac0317bc9cf\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/potatosalad/erlang-jose\", \"packageName\": \"potatosalad/erlang-jose\", \"programFiles\": [\"src/jwk/jose_jwk_kty_ec.erl\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"jose_jwk_kty_ec:verify/4\"}]}], \"references\": [{\"url\": \"https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-65632.html\", \"name\": \"EEF CNA record for CVE-2026-65632\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-65632\", \"name\": \"OSV record EEF-CVE-2026-65632\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429\", \"name\": \"Introducing commit a7746ec in potatosalad/erlang-jose\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf\", \"name\": \"Fix commit 72ce186 in potatosalad/erlang-jose\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (split_binary(Signature, byte_size(Signature) div 2)) instead of enforcing the fixed length required by RFC 7518 \\u00a73.4, and then decodes each half with crypto:bytes_to_integer/1, which ignores leading zero bytes.\\n\\nAs a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same (r, s) pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying (r, s) values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.\\n\\nThis issue affects jose: from 1.0.0 before 1.11.13.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe \u003ccode\u003ejose\u003c/code\u003e library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, \u003ccode\u003ejose_jwk_kty_ec:verify/4\u003c/code\u003e in \u003ccode\u003esrc/jwk/jose_jwk_kty_ec.erl\u003c/code\u003e splits the raw signature in half by its actual byte length (\u003ccode\u003esplit_binary(Signature, byte_size(Signature) div 2)\u003c/code\u003e) instead of enforcing the fixed length required by RFC 7518 \\u00a73.4, and then decodes each half with \u003ccode\u003ecrypto:bytes_to_integer/1\u003c/code\u003e, which ignores leading zero bytes.\u003c/p\u003e\\n\u003cp\u003eAs a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same \u003ccode\u003e(r, s)\u003c/code\u003e pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying \u003ccode\u003e(r, s)\u003c/code\u003e values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.\u003c/p\u003e\\n\u003cp\u003eThis issue affects jose: from 1.0.0 before 1.11.13.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"The `jose` library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, `jose_jwk_kty_ec:verify/4` in `src/jwk/jose_jwk_kty_ec.erl` splits the raw signature in half by its actual byte length (`split_binary(Signature, byte_size(Signature) div 2)`) instead of enforcing the fixed length required by RFC 7518 \\u00a73.4, and then decodes each half with `crypto:bytes_to_integer/1`, which ignores leading zero bytes.\\n\\nAs a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same `(r, s)` pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying `(r, s)` values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic.\\n\\nThis issue affects jose: from 1.0.0 before 1.11.13.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"CWE-347 Improper Verification of Cryptographic Signature\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.11.13\", \"versionStartIncluding\": \"1.0.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-10-26T19:53:56.649Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-65632\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-11-02T21:30:52.037Z\", \"dateReserved\": \"2026-07-22T13:58:26.233Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-10-26T19:53:56.649Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…