CVE-2026-65627

Published 26 October 2026 · tracked since 27 October 2026

Description

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-112646 MEDIUM 6.5
• CVE-2026-112651 HIGH 8.8
• CVE-2026-112634 MEDIUM 6.5
• CVE-2026-112637 HIGH 8.8
• CVE-2026-112629 MEDIUM 6.5
• CVE-2026-112633 MEDIUM 6.5
• CVE-2026-112623 HIGH 8.8
• CVE-2026-112626 HIGH 8.8
• CVE-2026-112614 MEDIUM 6.5
• CVE-2026-112485

→ Open the live CVE board · all tools