| Bug | bookworm | trixie | forky | sid | Description |
|---|
| CVE-2026-65632 | vulnerable | vulnerable (no DSA) | fixed | fixed | The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS s ... |
| CVE-2026-65631 | vulnerable | vulnerable (no DSA) | fixed | fixed | Inefficient Algorithmic Complexity in erlang-jose allows an unauthenti ... |
| CVE-2026-65630 | vulnerable | vulnerable (no DSA) | fixed | fixed | Observable Timing Discrepancy vulnerability in potatosalad jose allows ... |
| CVE-2026-65629 | vulnerable | vulnerable (no DSA) | fixed | fixed | Use of Password Hash With Insufficient Computational Effort in the jos ... |
| CVE-2026-65628 | vulnerable | vulnerable (no DSA) | fixed | fixed | jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/ ... |
| CVE-2026-65627 | vulnerable | vulnerable (no DSA) | fixed | fixed | Improper Handling of Highly Compressed Data (Data Amplification) vulne ... |
| CVE-2026-65626 | vulnerable | vulnerable (no DSA) | fixed | fixed | The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 modu ... |
| CVE-2026-65625 | vulnerable | vulnerable (no DSA) | fixed | fixed | The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of ... |
| CVE-2023-50966 | vulnerable (no DSA) | fixed | fixed | fixed | erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow atta ... |