EEF-CVE-2026-65627 Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in potatosalad jose erlang-jose allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The josejwezip:uncompress/2 function in src/jwe/josejwezip.erl decompresses the DEFLATE-compress...

CVE-2026-65627

The potatosalad jose (erlang-jose) library (versions 1.0.0 before 1.11.13 ) is vulnerable to a Decompression bomb (Data Amplification) via the jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl. The vulnerability stems from the use of zlib:inflate/2 on attacker-controlled streams with...