Hex/jose CVE-2026-65629: unknown
Weak PBKDF2 parameters for password-encrypted private-key export in jose
Action: Upgrade jose to 1.11.13 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.10.0 | 1.11.13 | - |
Fixed versions
| 1.11.13 |
Sources
- osv: EEF-CVE-2026-65629
- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc
- https://cna.erlef.org/cves/CVE-2026-65629.html
- https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9
- https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0
- https://hex.pm/packages/jose
CVE-2026-65629 · published · modified · JSON