CVE-2026-65629ModerateRevised 1 Nov

Weak PBKDF2 parameters for password-encrypted private-key export in jose

MSRC advisory NVD CVE.org

Assessment

Severity: Moderate
CVSS base score: Not published
Impact: Not stated
EPSS · 30-day forecast: No EPSS score collected
Public detection template: Unknown: detection-template evidence is disabled, incomplete or retained
Exploitation detected: Unknown: not stated by MSRC
Exploitability: Not assessed
Publicly disclosed: Unknown: not stated by MSRC
Customer action: Required: follow the MSRC remediation guidance
Component: Mariner
Weakness: CWE-916: Use of Password Hash With Insufficient Computational Effort
Issued by: EEF
Published: 31 Oct 2026 · October 2026
Last revised: 1 Nov 2026Information published.

Updates that fix it

0 KBs

No KB listed

No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.

Affected products

Open Source Software

2 affected products

azl3 rabbitmq-server 3.13.7-10 on Azure Linux 3.0
azl3 rabbitmq-server 3.13.7-9 on Azure Linux 3.0

What changed

Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
2 Nov 2026 · 16:27:39 UTC
Affected products: azl3 rabbitmq-server 3.13.7-9 on Azure Linux 3.0 → azl3 rabbitmq-server 3.13.7-10 on Azure Linux 3.0, azl3 rabbitmq-server 3.13.7-9 on Azure Linux 3.0
2 Nov 2026 · 09:04:36 UTC

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version

Field-level log (6)

Up to 100 recent field edits are shown; older edits may be outside retention.

2 Nov 2026 · 16:27:39 UTC Public detection templateNo Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
2 Nov 2026 · 16:27:39 UTC Source coverage: public-exploit-codeCurrent → Incomplete
2 Nov 2026 · 16:27:39 UTC Source coverage: first-epssCurrent → Incomplete
2 Nov 2026 · 16:27:39 UTC Source coverage: msrc-cvrfCurrent → Incomplete
2 Nov 2026 · 09:04:36 UTC Last revised31 Oct 2026 01:14 UTC → 1 Nov 2026 15:05 UTC
2 Nov 2026 · 09:04:36 UTC Affected productsazl3 rabbitmq-server 3.13.7-9 on Azure Linux 3.0 → azl3 rabbitmq-server 3.13.7-10 on Azure Linux 3.0, azl3 rabbitmq-server 3.13.7-9 on Azure Linux 3.0

Explore global source statements, affected packages and advisory history for CVE-2026-65629. The catalog has a separate collection scope from Microsoft release records.

Collected exploitation and prediction evidence

Risk source coverage

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Dated risk observations

Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.

Immutable source observations

1 recorded revisions

Each citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.

26 Oct 2026 20:35:31 UTC

Weak PBKDF2 parameters for password-encrypted private-key export in jose

cve-program · CVE-2026-65629 · Published