What’s Vulnerable › Products

potatosalad jose vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your potatosalad jose version is affected

Latest potatosalad jose vulnerabilities

• CVE-2026-65630 — Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose (CVSS 5.9)
• CVE-2026-65632 — ECDSA signature length is not validated in jose, allowing signature malleability (CVSS 5.1)
• CVE-2026-65631 — erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service (CVSS 6.9)
• CVE-2026-65629 — Weak PBKDF2 parameters for password-encrypted private-key export in jose (CVSS 7.4)
• CVE-2026-65628 — Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types (CVSS 5.9)
• CVE-2026-65627 — Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 (CVSS 6.9)
• CVE-2026-65626 — Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose (CVSS 5.9)
• CVE-2026-65625 — Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose (CVSS 5.9)