CVE-2026-65625 Details
Description
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on its length. Verification in gcm_block_decrypt/6 then computes TBits = bit_size(T) and compares only those bits of the real 128-bit tag. An attacker who controls a JWE token can truncate the authentication tag to as little as 8 bits, so only 8 bits are ever checked. This reduces forgery resistance from 2^-128 to 2^-8, and a forged ciphertext is reliably accepted as authentic within 256 attempts without knowledge of the key (an authentication tag forgery and integrity bypass). Supplying a tag longer than 128 bits instead causes a badmatch that crashes the decrypting process. The fallback is reached through the public JWE decryption path whenever AES-GCM is not provided by a native crypto NIF, for example on FIPS or stripped or older OTP builds. This issue affects jose: from 1.2.0 before 1.11.13.
A vulnerability exists in the pure-Erlang AES-GCM fallback of the Erlang jose library, specifically in versions 1.2.0 prior to 1.11.13. This vulnerability allows an attacker to control the length of the authentication tag, leading to tag truncation and forgery. The issue arises because the incoming tag is only checked for binary format, without a length validation. As a result, an attacker can truncate the tag to as little as 8 bits, significantly reducing the forgery resistance. A forged ciphertext can be accepted as authentic without knowledge of the encryption key, bypassing the integrity guarantees of the AES-GCM encryption.
Users can upgrade to jose version 1.11.13, where this vulnerability has been fixed. In this version, the AES-GCM implementation rejects authentication tags that are not exactly 128 bits, ensuring that only full-length tags are verified. For those unable to upgrade, a temporary workaround is to manually check the length of the authentication tag before decryption and reject any tags that are not 128 bits.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-65625.html | EEF | AdvisoryRemedy |
| https://github.com/potatosalad/erlang-jose/commit/3fa1f8e3efda0da5ce6f4c9984789f979dc02740 | EEF | Source CodeVendor |
| https://github.com/potatosalad/erlang-jose/commit/8848b172575fb7d7e1e2977e8ae0a21678d2157a | EEF | Source CodeVendor |
| https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-6gxw-6f7r-cjr6 | EEF | AdvisoryExploitRemedy |
| https://osv.dev/vulnerability/EEF-CVE-2026-65625 | EEF | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-354 | Improper Validation of Integrity Check Value | EEF |
Affected Products
| Product | Versions |
|---|---|
| potatosalad jose | >= 1.2.0, < 1.11.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | EEF |