[ Vendor · 8 CVEs ]
potatosalad
CVEs affecting potatosalad published in the last 30 days, plus any potatosalad CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-65632 | 26 Oct 2026 | CVSS 5.1 | potatosalad joseThe jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature… | |
| CVE-2026-65626 | 26 Oct 2026 | CVSS 5.9 | potatosalad joseThe pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered… | |
| CVE-2026-65627 | 26 Oct 2026 | CVSS 6.9 | potatosalad joseImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust… | |
| CVE-2026-65628 | 26 Oct 2026 | CVSS 5.9 | potatosalad josejose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only… | |
| CVE-2026-65629 | 26 Oct 2026 | CVSS 7.4 | potatosalad joseUse of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key… | |
| CVE-2026-65630 | 26 Oct 2026 | CVSS 5.9 | potatosalad joseObservable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in… | |
| CVE-2026-65631 | 26 Oct 2026 | CVSS 6.9 | potatosalad joseInefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting… | |
| CVE-2026-65625 | 26 Oct 2026 | CVSS 5.9 | potatosalad joseThe pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the… |