Improper Handling of Highly Compressed Data in jose by potatosalad

CVE-2026-65627

What is CVE-2026-65627?

A vulnerability exists in the jose library, specifically within the jose_jwe_zip:uncompress/2 function, where an attacker can exploit the way highly compressed data is handled. This flaw allows for memory exhaustion through the decompression of a crafted JWE token containing a DEFLATE-compressed payload. When exploited, a small token can inflate to a vast size well beyond its original dimensions, potentially reaching hundreds of megabytes or even gigabytes. The absence of size constraints during the decompression process can trigger extensive resource consumption on the affected node, leading to denial of service for legitimate users. Notably, this attack can be executed using only the recipient's public key, making it critical for users of the library to apply recommended patches and ensure they are running secure versions.

References