{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65629", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-07-22T13:58:26.233Z", "datePublished": "2026-10-26T19:53:35.646Z", "dateUpdated": "2026-10-26T19:53:35.646Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["jose_jwk_der", "jose_jwk", "'Elixir.JOSE.JWK'"], "packageName": "jose", "packageURL": "pkg:hex/jose", "product": "jose", "programFiles": ["src/jwk/jose_jwk_der.erl", "src/jwk/jose_jwk.erl", "lib/jose/jwk.ex"], "programRoutines": [{"name": "jose_jwk_der:to_binary/3"}, {"name": "jose_jwk:to_der/2"}, {"name": "'Elixir.JOSE.JWK':to_der/2"}], "repo": "https://github.com/potatosalad/erlang-jose", "vendor": "potatosalad", "versions": [{"lessThan": "1.11.13", "status": "affected", "version": "1.10.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["jose_jwk_der", "jose_jwk", "'Elixir.JOSE.JWK'"], "packageName": "potatosalad/erlang-jose", "packageURL": "pkg:github/potatosalad/erlang-jose", "product": "jose", "programFiles": ["src/jwk/jose_jwk_der.erl", "src/jwk/jose_jwk.erl", "lib/jose/jwk.ex"], "programRoutines": [{"name": "jose_jwk_der:to_binary/3"}, {"name": "jose_jwk:to_der/2"}, {"name": "'Elixir.JOSE.JWK':to_der/2"}], "repo": "https://github.com/potatosalad/erlang-jose", "vendor": "potatosalad", "versions": [{"lessThan": "461b261902531ca016190e780bb70862d561a7e0", "status": "affected", "version": "85fddd89ee56b6f9c19eff7d9cfffeef62c330b9", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.11.13", "versionStartIncluding": "1.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Andrew Bennett"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.</p>\n<p>When jose exports a password-encrypted private key with <code>jose_jwk:to_der/2</code> (<code>JOSE.JWK.to_der/2</code>), the <code>jose_jwk_der:to_binary/3</code> function in <code>src/jwk/jose_jwk_der.erl</code> serializes the key as a <code>PKCS#8</code> <code>EncryptedPrivateKeyInfo</code> using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.</p>\n<p>Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.</p>\n<p>This issue affects jose: from 1.10.0 before 1.11.13.</p>"}, {"base64": false, "type": "text/markdown", "value": "Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.\n\nWhen jose exports a password-encrypted private key with `jose_jwk:to_der/2` (`JOSE.JWK.to_der/2`), the `jose_jwk_der:to_binary/3` function in `src/jwk/jose_jwk_der.erl` serializes the key as a `PKCS#8` `EncryptedPrivateKeyInfo` using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.\n\nBoth values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.\n\nThis issue affects jose: from 1.10.0 before 1.11.13."}], "value": "Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.\n\nWhen jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.\n\nBoth values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.\n\nThis issue affects jose: from 1.10.0 before 1.11.13."}], "impacts": [{"capecId": "CAPEC-16", "descriptions": [{"lang": "en", "value": "CAPEC-16 Dictionary-based Password Attack"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 7.4, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-916", "description": "CWE-916 Use of Password Hash With Insufficient Computational Effort", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-10-26T19:53:35.646Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc"}, {"name": "EEF CNA record for CVE-2026-65629", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-65629.html"}, {"name": "OSV record EEF-CVE-2026-65629", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-65629"}, {"name": "Introducing commit 85fddd8 in potatosalad/erlang-jose", "tags": ["related"], "url": "https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9"}, {"name": "Fix commit 461b261 in potatosalad/erlang-jose", "tags": ["patch"], "url": "https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0"}], "source": {"discovery": "EXTERNAL"}, "title": "Weak PBKDF2 parameters for password-encrypted private-key export in jose", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>When exporting a password-encrypted private key with <code>jose_jwk:to_der/2</code> (<code>JOSE.JWK.to_der/2</code>), use a long, high-entropy passphrase, since the weak key-derivation work factor only meaningfully lowers the cost of cracking guessable passwords. Restrict access to exported <code>EncryptedPrivateKeyInfo</code> blobs and keep them out of backups, repositories, object storage, and logs that an attacker could read.</p>"}, {"base64": false, "type": "text/markdown", "value": "When exporting a password-encrypted private key with `jose_jwk:to_der/2` (`JOSE.JWK.to_der/2`), use a long, high-entropy passphrase, since the weak key-derivation work factor only meaningfully lowers the cost of cracking guessable passwords. Restrict access to exported `EncryptedPrivateKeyInfo` blobs and keep them out of backups, repositories, object storage, and logs that an attacker could read."}], "value": "When exporting a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), use a long, high-entropy passphrase, since the weak key-derivation work factor only meaningfully lowers the cost of cracking guessable passwords. Restrict access to exported EncryptedPrivateKeyInfo blobs and keep them out of backups, repositories, object storage, and logs that an attacker could read."}]}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["jose_jwk_der", "jose_jwk", "'Elixir.JOSE.JWK'"], "packageName": "jose", "packageURL": "pkg:hex/jose", "product": "jose", "programFiles": ["src/jwk/jose_jwk_der.erl", "src/jwk/jose_jwk.erl", "lib/jose/jwk.ex"], "programRoutines": [{"name": "jose_jwk_der:to_binary/3"}, {"name": "jose_jwk:to_der/2"}, {"name": "'Elixir.JOSE.JWK':to_der/2"}], "repo": "https://github.com/potatosalad/erlang-jose", "vendor": "potatosalad", "versions": [{"lessThan": "1.11.13", "status": "affected", "version": "1.10.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["jose_jwk_der", "jose_jwk", "'Elixir.JOSE.JWK'"], "packageName": "potatosalad/erlang-jose", "packageURL": "pkg:github/potatosalad/erlang-jose", "product": "jose", "programFiles": ["src/jwk/jose_jwk_der.erl", "src/jwk/jose_jwk.erl", "lib/jose/jwk.ex"], "programRoutines": [{"name": "jose_jwk_der:to_binary/3"}, {"name": "jose_jwk:to_der/2"}, {"name": "'Elixir.JOSE.JWK':to_der/2"}], "repo": "https://github.com/potatosalad/erlang-jose", "vendor": "potatosalad", "versions": [{"lessThan": "461b261902531ca016190e780bb70862d561a7e0", "status": "affected", "version": "85fddd89ee56b6f9c19eff7d9cfffeef62c330b9", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.\n\nWhen jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.\n\nBoth values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.\n\nThis issue affects jose: from 1.10.0 before 1.11.13."}], "id": "CVE-2026-65629", "lastModified": "2026-10-26T20:17:58.647", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}, "published": "2026-10-26T20:17:58.647", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-65629.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-65629"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-916"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{}