AZL-112193 CVE-2026-65632 affecting package rabbitmq-server 3.13.7-10

The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...

UBUNTU-CVE-2026-65632

The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...

Andrew Bennett JOSE encryption issue vulnerability

Versions of Andrew Bennett JOSE from 1.0.0 up to and including 1.11.13 contain an encryption vulnerability. This vulnerability arises because JOSEjwkktyec:verify/4 in src/jwk/JOSEjwkktyec.erl splits ECDSA ES256, ES256K, ES384, and ES512 JWS signatures into two halves based on the actual byte leng...