CVE-2026-65632

Name of the Vulnerable Software and Affected Versions jose versions 1.0.0 through 1.11.12

Description The library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. During verification, the function jose jwk kty ec:verify/4 in src/jwk/jose jwk kty ec.erl splits the raw signature based on its actual byte length using split binary(Signature, byte size(Signature) div 2) instead of enforcing the fixed length required by RFC 7518 §3.4. The halves are then decoded using crypto:bytes to integer/1, which ignores leading zero bytes. This leads to signature malleability, where an attacker with a valid token can prepend leading zero bytes to the R and S halves to create multiple distinct signature byte strings that verify against the same key. While this does not allow for payload forgery or signer impersonation, it bypasses security controls that rely on signature uniqueness, such as token-revocation-by-hash, deduplication logic, or replay and idempotency caches.

Recommendations Update jose to version 1.11.13.