CVE-2026-65626
Received Received - Intake

Bleichenbacher Oracle in jose Erlang RSAES-PKCS1-v1_5

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator) and returns a distinct error result otherwise, and rsaes_pkcs1_decrypt/2 additionally returns {error, {badsize, _}} when the length check fails. The implementation applies no implicit-rejection countermeasure (RFC 8017 §7.2.2): it does not substitute a deterministic pseudo-random plaintext on a padding failure, so a one-bit padding-conformance signal leaks to the caller. Because the underlying modular exponentiation in dp/2 is a raw, non-blinded crypto:mod_pow/3, the padding check also stays distinguishable by timing even when an application normalizes every failure to a single error value. An unauthenticated attacker who knows only the public RSA key and can submit ciphertexts to a decryption endpoint that unwraps RSA1_5 JWE keys (or otherwise calls decrypt_private/3 with rsa_pkcs1_padding) can use this oracle to recover the plaintext of intercepted ciphertexts, such as content-encryption keys and thus the protected message, or to forge signatures, through roughly 10^4 to 10^6 adaptive chosen-ciphertext queries. This issue affects jose: from 1.3.0 before 1.11.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-65626
EUVD
EUVD-2026-110304

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
potatosalad jose 1.3.0
potatosalad jose 853c5d4c4c0bd2a7ecb055b237f4284184e176c8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Bleichenbacher padding oracle in the pure-Erlang RSAES-PKCS1-v1.5 decryption of the jose_jwa_pkcs1 module. It leaks one-bit signals about padding conformity through timing and error responses during decryption. An unauthenticated attacker with access to a decryption endpoint can use this to recover plaintext or forge signatures by submitting roughly 10,000 to 1,000,000 adaptive chosen-ciphertext queries using only the public key.

Detection Guidance

Detecting this vulnerability requires checking if your system uses vulnerable versions of the jose library (1.3.0 to 1.11.12). Inspect installed packages with commands like 'mix deps' for Elixir or 'rebar3 deps' for Erlang. Look for jose versions below 1.11.13. Additionally, monitor decryption endpoints for unusual timing patterns or error responses during RSA decryption operations.

Impact Analysis

If you use the affected jose library versions (1.3.0 to 1.11.12) with RSAES-PKCS1-v1.5 decryption enabled, an attacker could recover sensitive data like content-encryption keys or protected messages from intercepted ciphertexts. They could also forge signatures without needing the private key. The impact is higher if the decryption endpoint is exposed to untrusted networks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A successful exploit could result in data breaches, triggering compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade the jose library to version 1.11.13 or later immediately. If upgrading is not possible, disable RSAES-PKCS1-v1_5 decryption by rejecting RSA1_5 tokens before processing. Alternatively, rate-limit decryption attempts to prevent adaptive chosen-ciphertext queries. Prefer RSA-OAEP or RSA-OAEP-256 algorithms for encryption and decryption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65626. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart