Packages

jose

1.11.13
1.11.13 1.11.12 1.11.11 1.11.10 1.11.9 1.11.8 1.11.7 1.11.6 1.11.5 1.11.4 1.11.2 1.11.1 1.11.0 1.10.1 1.10.0 1.9.0 1.8.4 1.8.3 1.8.2 1.8.1 1.8.0 1.7.9 1.7.8 1.7.7 1.7.6 1.7.5 1.7.4 1.7.3 1.7.2 1.7.1 1.7.0 1.6.1 1.6.0 1.5.2 1.5.1 1.5.0 1.4.2 1.4.1 1.4.0 1.3.0 1.2.0 1.1.3 1.1.2 1.1.1 1.1.0 1.0.1 1.0.0

JSON Object Signing and Encryption (JOSE) for Erlang and Elixir.

HexDocs Report package

Current section

9 Advisories

Jump to
Documentation
Changelog
License
47 Versions
0 Dependencies
150 Dependants
9 Advisories
Files
Activity
EEF-CVE-2026-65630 CVE-2026-65630 GHSA-xvr2-gggj-h2pp

Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

October 26, 2026
CVSS
?
5.9 / 10.0 Medium
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 1.10.0 and < 1.11.13
EEF-CVE-2026-65632 CVE-2026-65632 GHSA-44hw-rpw9-mwg4

ECDSA signature length is not validated in jose, allowing signature malleability

October 26, 2026
CVSS
?
5.1 / 10.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 1.0.0 and < 1.11.13
EEF-CVE-2026-65631 CVE-2026-65631 GHSA-3m45-vrpj-xmrq

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

October 26, 2026
CVSS
?
6.9 / 10.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Versions

>= 1.7.7 and < 1.11.13
EEF-CVE-2026-65629 CVE-2026-65629 GHSA-h4gx-8jq2-mfhc

Weak PBKDF2 parameters for password-encrypted private-key export in jose

October 26, 2026
CVSS
?
7.4 / 10.0 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 1.10.0 and < 1.11.13
EEF-CVE-2026-65628 CVE-2026-65628 GHSA-fpj2-9h59-32pp

Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

October 26, 2026
CVSS
?
5.9 / 10.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Versions

>= 1.5.0 and < 1.11.13
EEF-CVE-2026-65627 CVE-2026-65627 GHSA-wfpv-qxp8-x5gm

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

October 26, 2026
CVSS
?
6.9 / 10.0 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Versions

>= 1.0.0 and < 1.11.13
EEF-CVE-2026-65626 CVE-2026-65626 GHSA-vwvr-f994-6j9j

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

October 26, 2026
CVSS
?
5.9 / 10.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 1.3.0 and < 1.11.13
EEF-CVE-2026-65625 CVE-2026-65625 GHSA-6gxw-6f7r-cjr6

Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

October 26, 2026
CVSS
?
5.9 / 10.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Affected Versions

>= 1.2.0 and < 1.11.13
GHSA-9mg4-v392-8j68 CVE-2023-50966

erlang-jose vulnerable to denial of service via large p2c value

March 19, 2024
CVSS
?
5.3 / 10.0 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Versions

< 1.11.7

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions
0 20K 40K 60K 80K

this version

492 833

yesterday

24 735

last 7 days

398 697

all time

115 460 244

Last Updated

Oct 26, 2026

License

MIT

Build Tools

mix rebar3

Publisher

potatosalad potatosalad

Links

Owners