Appsup-dart Jose vulnerabilities

• appsup-dart jose Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose CVE-2026-65630 Fix available 5.9 MediumOctober 26, 2026
• appsup-dart jose ECDSA signature length is not validated in jose, allowing signature malleability CVE-2026-65632 Fix available 5.1 MediumOctober 26, 2026
• appsup-dart jose erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service CVE-2026-65631 Fix available 6.9 MediumOctober 26, 2026
• appsup-dart jose Weak PBKDF2 parameters for password-encrypted private-key export in jose CVE-2026-65629 Fix available 7.4 HighOctober 26, 2026
• appsup-dart jose Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types CVE-2026-65628 Fix available 5.9 MediumOctober 26, 2026
• appsup-dart jose Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 CVE-2026-65627 Fix available 6.9 MediumOctober 26, 2026
• appsup-dart jose Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose CVE-2026-65626 Fix available 5.9 MediumOctober 26, 2026
• appsup-dart jose Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose CVE-2026-65625 Fix available 5.9 MediumOctober 26, 2026
• appsup-dart jose In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only... CVE-2026-89086 Fix available 9.1 CriticalSeptember 10, 2026
• appsup-dart jose jose vulnerable to untrusted JWK header key acceptance during signature verification CVE-2026-34240 Fix available 7.5 HighMarch 31, 2026
• appsup-dart jose, fedoraproject fedora +1 more jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext CVE-2024-28176 Fix available 4.9 MediumMarch 7, 2024
• appsup-dart jose JOSE vulnerable to resource exhaustion via specifically crafted JWE CVE-2022-36083 Fix available 5.3 MediumSeptember 7, 2022
• appsup-dart jose, jose-node-cjs-runtime project jose-node-cjs-runtime +1 more Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime CVE-2021-29444 Fix available 5.9 MediumApril 16, 2021
• appsup-dart jose Padding Oracle Attack due to Observable Timing Discrepancy in jose CVE-2021-29443 Fix available 5.9 MediumApril 16, 2021