CVE-2026-65632
Received Received - Intake

ECDSA Signature Malleability in jose Library

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: EEF

Description
The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (split_binary(Signature, byte_size(Signature) div 2)) instead of enforcing the fixed length required by RFC 7518 §3.4, and then decodes each half with crypto:bytes_to_integer/1, which ignores leading zero bytes. As a result, an attacker who holds one valid token can prepend leading zero bytes to each of the R and S halves to produce longer signatures that still split evenly and decode to the same (r, s) pair, so many distinct signature byte strings all verify against the same key (signature malleability). This does not allow forging new payloads or impersonating a signer, because the underlying (r, s) values are unchanged. It does defeat any security control that assumes a valid token or its signature is unique, such as token-revocation-by-hash, replay or idempotency caches, and deduplication logic. This issue affects jose: from 1.0.0 before 1.11.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-65632
EUVD
EUVD-2026-110310

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
potatosalad jose 1.0.0
potatosalad jose a7746ecd4950f85a393136e449a91dac62b5c429

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65632 is a signature malleability issue in the jose library affecting ECDSA signature verification for JWS tokens (ES256, ES256K, ES384, ES512). The library improperly validates signature lengths by splitting raw signatures based on actual byte length instead of the fixed length required by RFC 7518. This allows attackers to prepend leading zero bytes to signature halves, creating multiple distinct byte strings that still verify against the same key without changing the underlying (r, s) values.

Detection Guidance

To detect this vulnerability, check if your system uses the affected jose library versions (1.0.0 to 1.11.12). Inspect installed packages for erlang-jose or jose. Use commands like 'erl -eval "io:format("~s~n", [jose:version()])." -s init stop' in Erlang environments or 'npm list jose' for Node.js projects. Look for signatures processed by ECDSA algorithms (ES256, ES256K, ES384, ES512) that may have non-canonical lengths.

Impact Analysis

This vulnerability can undermine security controls that rely on signature uniqueness, such as token revocation by hash, replay prevention, idempotency caches, or deduplication logic. While it does not allow forging new payloads or impersonating signers, it enables attackers to bypass these protections by generating multiple valid signatures for the same token.

Mitigation Strategies
  • Upgrade the jose library to version 1.11.13 or later to address the signature length validation issue.
  • If upgrading is not possible, implement manual signature length checks before verification to enforce RFC 7518-compliant lengths.
  • Review and update security controls relying on signature uniqueness, such as token revocation, replay prevention, or deduplication systems, to account for potential malleability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65632. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart