CVE-2026-65627 in jose
Summary
by MITRE • 10/26/2026
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token.
The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call.
Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users.
This issue affects jose: from 1.0.0 before 1.11.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified as Improper Handling of Highly Compressed Data, commonly referred to as a Zip Bomb or data amplification attack, resides within the potatosalad jose library for Erlang and Elixir. This security flaw specifically impacts versions from 1.0.0 up to but not including 1.11.13. The core issue stems from the implementation of the DEFLATE decompression logic used when processing JSON Web Encryption tokens that include a zip header indicating compressed content. When an application receives such a token, the library automatically attempts to decompress the payload as part of the decryption workflow before any business logic or validation can inspect the resulting plaintext. This automatic execution path is critical because it means the vulnerability can be triggered without requiring prior authentication or access to secret keys in many common configurations.
The technical root cause lies within the jose_jwe_zip:uncompress/2 function located in src/jwe/jose_jwe_zip.erl. During operation, this function invokes zlib:inflate/2 on a stream that is entirely controlled by the remote attacker. Crucially, there are no bounds imposed on either the output size or the inflation ratio of the decompression process. DEFLATE compression algorithms are known to achieve extremely high compression ratios when applied to highly repetitive data patterns. An attacker can craft a small input file, typically only a few kilobytes in size, that expands into hundreds of megabytes or even gigabytes upon decompression. Because the library processes this entire inflated stream at once without limiting memory allocation for the result, it rapidly consumes available heap space on the BEAM virtual machine node hosting the application.
The operational impact of this vulnerability is severe and results in a complete denial of service against the affected system. Since the decompression occurs during the decryption phase via jose_jwe:block_decrypt/2 or its Elixir equivalent JOSE.JWE.block_decrypt/2, the memory exhaustion happens before any recipient-side validation can reject the malicious payload. In scenarios utilizing asymmetric key management algorithms such as RSA-OAEP or Elliptic Curve Diffie-Hellman Ephemeral Static, an attacker requires only the public key of the intended recipient to construct a valid JWE token that triggers this flaw. This eliminates the need for any secret material or authentication credentials, allowing unauthenticated remote attackers to target systems exposed via standard API endpoints or message queues that process encrypted data. The resulting memory exhaustion causes the BEAM node to crash, effectively denying service to all users connected to that specific node and potentially causing cascading failures in clustered environments if not properly isolated.
From a classification perspective, this vulnerability aligns with CWE-409 Improper Handling of Highly Compressed Data which describes scenarios where software fails to limit the size or complexity of decompressed data leading to resource exhaustion. It also maps directly to MITRE ATT&CK technique T1496 Resource Hijacking under the sub-technique of CPU/Network Bandwidth Consumption, although in this specific instance the primary vector is memory consumption rather than just computational load. The attack leverages the inherent properties of lossless compression algorithms to create a disproportionate resource demand relative to the input size, exploiting the trust placed in standard cryptographic libraries to handle data safely without explicit bounds checking for decompression limits.
Mitigation strategies must focus on immediate patching and architectural safeguards. Organizations running affected versions should upgrade potatosalad jose to version 1.11.13 or later where this issue has been addressed with proper size limiting during the inflation process. For systems that cannot be immediately patched, defensive measures include implementing strict input validation at the network perimeter to reject JWE tokens containing zip headers if such compression is not strictly required by business logic. Additionally, deploying resource limits within the BEAM runtime environment can help contain the blast radius of a single node compromise. Monitoring for unusual spikes in memory usage associated with cryptographic operations may also provide early detection signals for ongoing exploitation attempts before total system failure occurs.