CVE-2026-65628Published
Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-65628 · Microsoft / collected KEV context
cve-program · CVE-2026-65628
- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-fpj2-9h59-32pp
- https://cna.erlef.org/cves/CVE-2026-65628.html
- https://osv.dev/vulnerability/EEF-CVE-2026-65628
- https://github.com/potatosalad/erlang-jose/commit/7b80b9f55b9898e1a6901ce136061b241b021d7c
- https://github.com/potatosalad/erlang-jose/commit/26182a7de63b91550035d3f08741f7d17f1f675a
Related operational evidence
Explicit CVE identifiers- Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types · Newly collected advisory · 26 Oct 2026