Hex/jose CVE-2026-65630: unknown, EPSS 0.14%
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
Action: Upgrade jose to 1.11.13 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.10.0 | 1.11.13 | - |
Fixed versions
| 1.11.13 |
Sources
- osv: EEF-CVE-2026-65630
- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-xvr2-gggj-h2pp
- https://cna.erlef.org/cves/CVE-2026-65630.html
- https://github.com/potatosalad/erlang-jose/commit/8e532095de114ef4bf88a9ec5d651fa251a972b3
- https://github.com/potatosalad/erlang-jose/commit/3670f873c274bba86fb7f5ee5727a7efa1322b79
- https://hex.pm/packages/jose
CVE-2026-65630 · published · modified · JSON