Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-65629— Weak PBKDF2 parameters for password-encrypted private-key export in jose

Quick assessment

Affected

potatosalad jose

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

jose 库中使用了计算强度不足的密码哈希算法，导致攻击者若获取到以密码加密的私钥导出文件，即可通过离线密码破解攻击恢复该私钥。当 jose 通过（即）导出密码加密的私钥时，中的函数会将密钥序列化为 PKCS#8 格式的，并采用 PBES2 方案，其中密钥派生参数被硬编码为：PBKDF2-HMAC-SHA256，迭代次数固定为 2048 次，随机盐长度仅为 8 字节（64 位）。调用方无法覆盖这两个参数。上述两个参数值均远低于当前安全指南推荐值（OWASP 建议 PBKDF2-HMAC-SHA256

CVSS 7.4 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1003.002 · Security Account Manager T1110.001 · Password Guessing

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Weak PBKDF2 parameters for password-encrypted private-key export in jose

Source: CVE Program / CVE List V5

Vulnerability Description

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller. Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key. This issue affects jose: from 1.10.0 before 1.11.13.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用具有不充分计算复杂性的口令哈希

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
potatosalad	jose	1.10.0 ~ 1.11.13	`cpe:2.3:a:potatosalad:jose::::::::`
potatosalad	jose	85fddd89ee56b6f9c19eff7d9cfffeef62c330b9 ~ 461b261902531ca016190e780bb70862d561a7e0	`cpe:2.3:a:potatosalad:jose::::::::`

II. Public POCs for CVE-2026-65629

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-65629

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-65629 (2)

Vendor Advisories for CVE-2026-65629 (2)

🔗 Weak PBKDF2 parameters for encrypted private-key export · Advisory · potatosalad/erlang-jose · GitHub Read full article vendor-advisory related
🔗 CVE-2026-65629 related

Other References for CVE-2026-65629 (1)

🔗 EEF-CVE-2026-65629 - OSV Read full article related

https://www.cve.org/CVERecord?id=CVE-2026-65629

Same Patch Batch · potatosalad · 2026-10-26 · 8 CVEs total

CVE-2026-65627	6.9 MEDIUM	Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
CVE-2026-65631	6.9 MEDIUM	erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CP
CVE-2026-65626	5.9 MEDIUM	Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
CVE-2026-65628	5.9 MEDIUM	Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key t
CVE-2026-65625	5.9 MEDIUM	Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
CVE-2026-65630	5.9 MEDIUM	Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in j
CVE-2026-65632	5.1 MEDIUM	ECDSA signature length is not validated in jose, allowing signature malleability

IV. Related Vulnerabilities

Same product: jose

Same vendor: potatosalad

Same weakness: CWE-916