Inefficient Algorithmic Complexity in Erlang-Jose Affects Users

CVE-2026-65631

What is CVE-2026-65631?

An inefficiency in the Erlang-Jose library allows unauthenticated remote attackers to exhaust CPU resources by submitting specially crafted RSA JSON Web Keys (JWKs). When the API processes an untrusted JWK, an improperly structured RSA key that lacks critical parameters leads to excessive resource consumption as the application attempts to recover missing values through an ineffective algorithm. Attackers can exploit this behavior to flood the service with requests, saturating system resources and crippling functionality, all without needing valid credentials or complex configurations.

References