[Git][security-tracker-team/security-tracker][master] Add CVE-2026-65632/erlang-jose

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4bf83e1c by Salvatore Bonaccorso at 2026-10-27T15:19:40+01:00
Add CVE-2026-65632/erlang-jose

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -155,7 +155,12 @@ CVE-2026-65686
 CVE-2026-65685
 	REJECTED
 CVE-2026-65632 (The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS s ...)
-	TODO: check
+	- erlang-jose <unfixed>
+	NOTE: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-44hw-rpw9-mwg4
+	NOTE: https://cna.erlef.org/cves/CVE-2026-65632.html
+	NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-65632
+	NOTE: Introduced with: https://github.com/potatosalad/erlang-jose/commit/a7746ecd4950f85a393136e449a91dac62b5c429 (1.0.0)
+	NOTE: Fixed by: https://github.com/potatosalad/erlang-jose/commit/72ce1866622b9329347dc52a94173ac0317bc9cf (1.11.13)
 CVE-2026-65631 (Inefficient Algorithmic Complexity in erlang-jose allows an unauthenti ...)
 	TODO: check
 CVE-2026-65630 (Observable Timing Discrepancy vulnerability in potatosalad jose allows ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4bf83e1cfca7c0506ec6eb12cfee1df23b7a7be7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4bf83e1cfca7c0506ec6eb12cfee1df23b7a7be7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/23ac4091/attachment.htm>