CVE-2026-65625

Name of the Vulnerable Software and Affected Versions jose versions 1.2.0 through 1.11.12

Description The pure-Erlang AES-GCM fallback in jose jwa aes derives the number of verified authentication tag bits from the attacker-supplied tag. In the {aes gcm, Bits} clause of the block decrypt/4 function, the incoming tag is guarded only by is binary/1 without a length check. Subsequently, the gcm block decrypt/6 function computes TBits = bit size(T) and compares only those bits against the actual 128-bit tag. An attacker controlling a JWE token can truncate the authentication tag to as little as 8 bits, reducing forgery resistance from 2^-128 to 2^-8. This allows a forged ciphertext to be accepted as authentic within 256 attempts without the key, resulting in an authentication tag forgery and integrity bypass. Additionally, providing a tag longer than 128 bits causes a badmatch that crashes the decryption process. This issue occurs when AES-GCM is not provided by a native crypto NIF (Native Implemented Function), such as in FIPS, stripped, or older OTP builds.

Recommendations Update jose to version 1.11.13 or later. Ensure the runtime provides a crypto provider with native AES-GCM support, such as a standard Erlang/OTP build linked against OpenSSL, to ensure AES-GCM is dispatched to the native crypto NIF instead of the jose jwa aes fallback.