CVE-2026-65626

Name of the Vulnerable Software and Affected Versions jose versions 1.3.0 through 1.11.12

Description The jose jwa pkcs1 module contains a Bleichenbacher padding oracle in its pure-Erlang RSAES-PKCS1-v1 5 decryption. The function eme pkcs1 decode/2 returns the recovered message for valid PKCS#1 v1.5 padding but returns a distinct error otherwise. Additionally, rsaes pkcs1 decrypt/2 returns {error, {badsize, }} upon length check failure. The implementation lacks implicit-rejection countermeasures, failing to substitute a deterministic pseudo-random plaintext during padding failures, which leaks a padding-conformance signal. Furthermore, the use of non-blinded crypto:mod pow/3 in the dp/2 function allows the padding check to be distinguishable via timing attacks, even if error values are normalized. An unauthenticated attacker with the public RSA key can submit ciphertexts to a decryption endpoint that unwraps RSA1 5 JWE keys or calls decrypt private/3 with rsa pkcs1 padding to recover plaintext, such as content-encryption keys, or forge signatures using adaptive chosen-ciphertext queries. This issue is only triggered when the crypto fallback option is enabled and the OTP runtime lacks native RSA1 5 decryption.

Recommendations Update jose to version 1.11.13 or later. Disable the crypto fallback option to ensure the native OTP public key implementation is used instead of the jose jwa pkcs1 module.