{
  "affected": [
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-65629.json"
      },
      "package": {
        "ecosystem": "Hex",
        "name": "jose",
        "purl": "pkg:hex/jose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.11.13"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "1.10.0",
        "1.10.1",
        "1.11.0",
        "1.11.1",
        "1.11.10",
        "1.11.11",
        "1.11.12",
        "1.11.2",
        "1.11.4",
        "1.11.5",
        "1.11.6",
        "1.11.7",
        "1.11.8",
        "1.11.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://cna.erlef.org/osv/EEF-CVE-2026-65629.json"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "85fddd89ee56b6f9c19eff7d9cfffeef62c330b9"
            },
            {
              "fixed": "461b261902531ca016190e780bb70862d561a7e0"
            }
          ],
          "repo": "https://github.com/potatosalad/erlang-jose",
          "type": "GIT"
        }
      ],
      "versions": [
        "1.11.12",
        "1.11.11",
        "1.11.10",
        "1.11.9",
        "1.11.8",
        "1.11.7",
        "1.11.5",
        "1.11.4",
        "1.11.2",
        "1.11.1",
        "1.11.0",
        "1.10.1",
        "1.10.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65629",
    "GHSA-h4gx-8jq2-mfhc"
  ],
  "credits": [
    {
      "name": "Peter Ullrich",
      "type": "REPORTER"
    },
    {
      "name": "Andrew Bennett",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Jonatan Männchen / EEF",
      "type": "ANALYST"
    }
  ],
  "database_specific": {
    "capec_ids": [
      "CAPEC-16"
    ],
    "cpe_ids": [
      "cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
      "CWE-916"
    ]
  },
  "details": "## Summary\n\nUse of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.\n\nWhen jose exports a password-encrypted private key with `jose_jwk:to_der/2` (`JOSE.JWK.to_der/2`), the `jose_jwk_der:to_binary/3` function in `src/jwk/jose_jwk_der.erl` serializes the key as a `PKCS#8` `EncryptedPrivateKeyInfo` using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.\n\nBoth values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.\n\nThis issue affects jose: from 1.10.0 before 1.11.13.\n\n## Workarounds\n\nWhen exporting a password-encrypted private key with `jose_jwk:to_der/2` (`JOSE.JWK.to_der/2`), use a long, high-entropy passphrase, since the weak key-derivation work factor only meaningfully lowers the cost of cracking guessable passwords. Restrict access to exported `EncryptedPrivateKeyInfo` blobs and keep them out of backups, repositories, object storage, and logs that an attacker could read.",
  "id": "EEF-CVE-2026-65629",
  "modified": "2026-10-26T20:11:07.577062118Z",
  "published": "2026-10-26T19:53:35.646Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-65629.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9"
    },
    {
      "type": "FIX",
      "url": "https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0"
    },
    {
      "type": "PACKAGE",
      "url": "https://hex.pm/packages/jose"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Weak PBKDF2 parameters for password-encrypted private-key export in jose"
}