418 matches found
CVE-2026-65632
A flaw was found in jose. When verifying Elliptic Curve Digital Signature Algorithm ECDSA signatures, the library does not enforce fixed signature lengths and ignores leading zero bytes. An attacker with a valid token can alter the signature format while keeping it cryptographically valid, causin...
CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
Linux Distros Unpatched Vulnerability : CVE-2026-65632
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/...
CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
DEBIAN-CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
AZL-112193 CVE-2026-65632 affecting package rabbitmq-server 3.13.7-11
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
AZL-111161 CVE-2026-65632 affecting package jose 14-3
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
UBUNTU-CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
EEF-CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability
Summary The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature...
CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
CVE-2026-65632
The jose library (versions 1.0.0 to before 1.11.13 ) is vulnerable to ECDSA signature malleability due to a failure in validating signature lengths for ES256, ES256K, ES384, and ES512 JWS signatures. The root cause is located in src/jwk/jose_jwk_kty_ec.erl, where the jose_jwk_kty_ec:verify/4 func...
CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
EUVD-2026-110310
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
CVE-2026-65632
The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...
PT-2026-125117
Name of the Vulnerable Software and Affected Versions jose versions 1.0.0 through 1.11.12 Description The library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. During verification, the function jose jwk kty ec:verify/4 in src/jwk/jose jwk kty ec.erl split...
CVE-2026-102595
Impact For some HTTP request paths, Synapse will ignore extraneous path segments and therefore serve a resource at an unexpected path. This could allow evasion of external rate-limiting that may be in place. The Client-Server API "/matrix/client", Federation API "/matrix/federation", Synapse Admi...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...
