Skip to contentPotatosalad Jose vulnerabilities
- appsup-dart joseTiming side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in joseCVE-2026-65630Fix available5.9 Medium
- appsup-dart joseECDSA signature length is not validated in jose, allowing signature malleabilityCVE-2026-65632Fix available5.1 Medium
- appsup-dart joseerlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of serviceCVE-2026-65631Fix available6.9 Medium
- appsup-dart joseWeak PBKDF2 parameters for password-encrypted private-key export in joseCVE-2026-65629Fix available7.4 High
- appsup-dart joseInfinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key typesCVE-2026-65628Fix available5.9 Medium
- appsup-dart joseDecompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2CVE-2026-65627Fix available6.9 Medium
- appsup-dart joseBleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in joseCVE-2026-65626Fix available5.9 Medium
- appsup-dart joseAttacker-controlled AES-GCM authentication tag length allows tag forgery in joseCVE-2026-65625Fix available5.9 Medium
- potatosalad erlang-joseerlang-jose vulnerable to denial of service via large p2c valueCVE-2023-50966Fix available5.3 Medium