目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-65630— jose X25519 标量乘法时序侧信道泄露私钥

一分钟漏洞结论

影响对象
potatosalad jose
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

potatosalad jose 中存在“可观测时序差异”漏洞，攻击者可通过纯 Erlang 实现的 Curve25519 回退路径中的时序侧信道，恢复长期使用的 X25519 私钥。 该纯 Erlang 版本的 X25519 实现，在利用递归 Montgomery 阶梯（ ）对秘密私钥执行标量乘法时，其子句会根据经钳位（clamped）的私有标量的各个比特位进行分支；且其每一步操作（ 与 ）以及域逆运算，均基于依赖具体数值的 Erlang 大整数算术（包括乘法、取余和模幂运算）。尽管该阶梯在操作次数上保持平衡并固

CVSS 5.9 · Medium
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-65630 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
来源: CVE Program / CVE List V5
Vulnerability Description
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (jose_jwa_x25519:curve25519/2) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations (jose_jwa_x25519:montgomery_add/3 and jose_jwa_x25519:montgomery_double/1) and field inversion are built from value-dependent Erlang bignum arithmetic (multiplication, remainder, and modular exponentiation). Although the ladder is operation-count balanced and fixed at 254 steps, the concrete integer values processed at each step, and therefore the running time, depend on the secret scalar. The execution time of the public entry points jose_jwa_x25519:scalarmult/2, jose_jwa_x25519:x25519/2, jose_jwa_x25519:x25519_base/1, and jose_jwa_x25519:sk_to_pk/1 is thus a function of the private key. This path is reachable from the public API, most notably when a service decrypts attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 key (for example through JOSE.JWK.box_decrypt_ecdh_es/2, which reaches jose_jwa_curve25519:x25519_shared_secret/2 and the ladder). An attacker who can submit ciphertexts and measure decryption timing can, in principle, recover the private key bit by bit, defeating the resistance X25519 was designed to provide. Recovery of the key compromises the confidentiality and authenticity of all data protected by it. This issue affects jose: from 1.10.0 before 1.11.13.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
potatosalad jose 1.10.0 ~ 1.11.13 cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*
potatosalad jose 8e532095de114ef4bf88a9ec5d651fa251a972b3 ~ 3670f873c274bba86fb7f5ee5727a7efa1322b79 cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*

二、漏洞 CVE-2026-65630 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-65630 的情报信息

请登录查看更多情报信息。

CVE-2026-65630 补丁与修复 (1)

CVE-2026-65630 厂商安全公告 (3)

同批安全公告 · potatosalad · 2026-10-26 · 共 8 条

CVE-2026-65629 7.4 HIGH jose 弱 PBKDF2 参数致私钥导出漏洞
CVE-2026-65627 6.9 MEDIUM jose_jwe_zip 解压缩炸弹漏洞
CVE-2026-65631 6.9 MEDIUM erlang-jose RSA JWK 解析导致 CPU 耗尽拒绝服务漏洞
CVE-2026-65626 5.9 MEDIUM jose RSAES-PKCS1-v1_5 解密填充预言机漏洞
CVE-2026-65628 5.9 MEDIUM JOSE 无限递归导致 CPU 拒绝服务漏洞
CVE-2026-65625 5.9 MEDIUM jose 库 AES-GCM 标签伪造漏洞
CVE-2026-65632 5.1 MEDIUM jose ECDSA 签名长度未验证致签名可篡改漏洞

IV. Related Vulnerabilities

Same product: jose
Same vendor: potatosalad
Same weakness: CWE-208