Denial of Service Vulnerability in jose Library by Potatosalad

CVE-2026-65628

What is CVE-2026-65628?

The jose library contains a vulnerability where the shared_secret function can enter an unbounded tail-recursive loop if supplied with JWKs of differing key types. An attacker can exploit this flaw to create an endless loop, which consumes 100% of CPU resources, leading to a denial of service for applications relying on shared secret derivation. The issue arises when the key types do not match, and as a result, the function keeps re-invoking itself without crashing, ultimately exhausting system resources. This vulnerability is present in jose versions from 1.5.0 to 1.11.12.

References