CVE-2026-65627

The potatosalad jose (erlang-jose) library (versions 1.0.0 before 1.11.13 ) is vulnerable to a Decompression bomb (Data Amplification) via the jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl. The vulnerability stems from the use of zlib:inflate/2 on attacker-controlled streams with...