CVE-2026-65630
Received Received - Intake

Timing Side Channel in jose X25519 Private Key Recovery

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (jose_jwa_x25519:curve25519/2) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations (jose_jwa_x25519:montgomery_add/3 and jose_jwa_x25519:montgomery_double/1) and field inversion are built from value-dependent Erlang bignum arithmetic (multiplication, remainder, and modular exponentiation). Although the ladder is operation-count balanced and fixed at 254 steps, the concrete integer values processed at each step, and therefore the running time, depend on the secret scalar. The execution time of the public entry points jose_jwa_x25519:scalarmult/2, jose_jwa_x25519:x25519/2, jose_jwa_x25519:x25519_base/1, and jose_jwa_x25519:sk_to_pk/1 is thus a function of the private key. This path is reachable from the public API, most notably when a service decrypts attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 key (for example through JOSE.JWK.box_decrypt_ecdh_es/2, which reaches jose_jwa_curve25519:x25519_shared_secret/2 and the ladder). An attacker who can submit ciphertexts and measure decryption timing can, in principle, recover the private key bit by bit, defeating the resistance X25519 was designed to provide. Recovery of the key compromises the confidentiality and authenticity of all data protected by it. This issue affects jose: from 1.10.0 before 1.11.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-65630
EUVD
EUVD-2026-110311

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
potatosalad jose 1.10.0
potatosalad jose 8e532095de114ef4bf88a9ec5d651fa251a972b3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a timing side-channel vulnerability in the pure-Erlang X25519 implementation of the jose library. It allows an attacker to recover a long-term X25519 private key by measuring decryption timing differences caused by secret-dependent operations in the Curve25519 fallback. The recursive Montgomery ladder used for scalar multiplication branches on private key bits, and value-dependent Erlang bignum arithmetic causes execution time to vary with the secret scalar.

Detection Guidance

Detecting this vulnerability requires checking if your system uses the vulnerable jose library versions (1.10.0 to 1.11.12) with the pure-Erlang X25519 fallback enabled. Inspect installed packages for erlang-jose or jose and verify versions. Check if services using the library process attacker-supplied ECDH-ES (JWE) messages with long-term X25519 keys.

Impact Analysis

If you use the jose library versions 1.10.0 to 1.11.12 with the pure-Erlang fallback enabled, an attacker could submit crafted ciphertexts and measure decryption timing to recover your long-term X25519 private key. This would allow them to decrypt all data protected by that key and forge signatures, compromising confidentiality and authenticity of communications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data protected by X25519 keys, violating confidentiality requirements in GDPR and HIPAA. Compromise of private keys may result in data breaches, requiring breach notifications under these regulations and potential regulatory penalties.

Mitigation Strategies

Upgrade to jose version 1.11.13 or later to disable the vulnerable pure-Erlang fallback by default. Alternatively, switch to a constant-time native X25519 implementation like libsodium, libdecaf, or Erlang/OTP's crypto application. Disable crypto_fallback if using older versions and avoid processing attacker-supplied ECDH-ES messages with long-term keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart