potatosalad jose

• CVE-2026-65630 Medium 5.9 Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose 0.1%
• CVE-2026-65632 Medium 5.1 ECDSA signature length is not validated in jose, allowing signature malleability <0.1%
• CVE-2026-65631 Medium 6.9 erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service 0.2%
• CVE-2026-65629 High 7.4 Weak PBKDF2 parameters for password-encrypted private-key export in jose <0.1%
• CVE-2026-65628 Medium 5.9 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types 0.1%
• CVE-2026-65627 Medium 6.9 Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 0.2%
• CVE-2026-65626 Medium 5.9 Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose <0.1%
• CVE-2026-65625 Medium 5.9 Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose 0.1%