Medium · CVSS 6.9CVE-2026-65627

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2CVE-2026-65627

Answer in brief

CVE-2026-65627 records a Medium severity (CVSS 6.9) vulnerability in Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2. The current sources do not mark it as known exploited. The current feed maps potatosalad/jose (generic), potatosalad/potatosalad/erlang-jose (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 26, 2026Updated Oct 26, 2026Source checked Oct 26, 2026First seen by HOL Oct 26, 2026Material review Oct 26, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.9
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps potatosalad/jose (generic), potatosalad/potatosalad/erlang-jose (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
potatosalad/josegeneric	>=1.0.0 <1.11.13	1.11.13
potatosalad/potatosalad/erlang-josegeneric	>=a7746ecd4950f85a393136e449a91dac62b5c429 <857eb8e7f2d33e2c9ca2189e77226561cacaf2ad	857eb8e7f2d33e2c9ca2189e77226561cacaf2ad

Recommended response

Check inventory. Check lockfiles and deployed manifests for potatosalad/jose, potatosalad/potatosalad/erlang-jose.
Review the reported fix. Source-reported workaround: Reject JWE tokens that carry a zip header before passing them to jose_jwe:block_decrypt/2. DEFLATE compression is rarely used in legitimate JWE traffic, so untrusted tokens whose protected header contains zip: DEF can be inspected and filtered out before decryption.

Evidence timeline and material changes

Published upstream
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 26, 2026

Sources and claim methodology

Upstream source description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call. Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users. This issue affects jose: from 1.0.0 before 1.11.13.

Quoted source text, attributed separately from HOL analysis.