Timing Attack Vulnerability in jose Library Affecting Erlang Products

CVE-2026-65626

What is CVE-2026-65626?

The jose library for Erlang has a vulnerability due to improper handling of RSAES-PKCS1-v1_5 decryption, exposing it to padding oracle attacks. This flaw allows unauthenticated attackers, who possess the public RSA key, to exploit a lack of countermeasures against timing and error signal responses. By sending crafted ciphertexts to a decryption endpoint, the attacker can recover plaintext messages and potentially forge signatures by performing a significant number of adaptive chosen-ciphertext queries. The issue arises from the failure to implement adequate defenses against timing attacks and error feedback, jeopardizing the security of encrypted data.

References