CVE-2026-65632
1 advisory.
Hex/jose CVE-2026-65632: unknown
ECDSA signature length is not validated in jose, allowing signature malleability
Action: Upgrade jose to 1.11.13 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 1.11.13 | - |
Fixed versions
| 1.11.13 |
Sources
- osv: EEF-CVE-2026-65632
- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4
- https://cna.erlef.org/cves/CVE-2026-65632.html
- https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429
- https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf
- https://hex.pm/packages/jose
CVE-2026-65632 · published · modified · JSON