ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-65630

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallba

Published Oct 26, 2026 · catalog updated Oct 27, 2026 · Observable Timing Discrepancy vulnerability

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-65630. EPSS is 0.14%. Act only if a listed version of Observable Timing Discrepancy vulnerability is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Observable Timing Discrepancy vulnerability).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.14%
Remediation
Advisory link
Affected products
Debian:12 erlang-jose · Debian:13 erlang-jose · Debian:14 erlang-jose · Hex jose

## Summary Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder ( ) whose clauses branch on individual bits of the clamped private scalar, and whose per-step operations ( and ) and field inversion are built from value-dependent Erlang bignum arithmetic (multiplication, remainder, and modular exponentiation). Although the ladder is operation-count balanced and fixed at 254 steps, the concrete integer values processed at each step, and therefore the running time, depend on the secret scalar. The execution time of the public entry points , , , and is thus a function of the private key. This path is reachable from the public API, most notably when a service decrypts attacker-supplied ECDH-ES (JWE) messages with a long-term X25519 key (for example through , which reaches and the ladder). An attacker who can submit ciphertexts and measure decryption timing can, in principle, recover the private key bit by bit, defeating the resistance X25519 was designed to provide. Recovery of the key compromises the confidentiality and authenticity of all data protected by it. This issue affects jose: from 1.10.0 before 1.11.13. ## Workarounds Use a constant-time native X25519 implementation for private-key operations: install the libsodium or libdecaf NIF, or run on an OTP release whose application provides , and do not force the pure-Erlang Curve25519 fallback ( or ) for long-lived keys. ## Configurations The vulnerability is only exploitable when X25519 private-key operations run through the pure-Erlang Curve25519 fallback, for example when the crypto fallback is enabled ( or ) or when no constant-time native X25519 implementation (a libsodium or libdecaf NIF, or the OTP application providing ) is available. Deployments that

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Debian:12 erlang-jose1.11.10-1, 1.11.10-1~bpo12+1, 1.11.12-1
  • Debian:13 erlang-jose1.11.10-1, 1.11.12-1, 1.11.12-1.1
  • Debian:14 erlang-jose1.11.10-1, 1.11.12-1, 1.11.12-1.1
  • Hex jose1.10.0 → 1.11.13

How to fix CVE-2026-65630

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-65630. EPSS is 0.14%. Act only if a listed version of Observable Timing Discrepancy vulnerability is installed.

Which versions are affected?

Compare what you have installed with 1.11.10-1, 1.11.10-1~bpo12+1, 1.11.12-1, 1.11.10-1, 1.11.12-1, 1.11.12-1.1, 1.10.0 → 1.11.13. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-208. EPSS 0.14%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Debian security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · GitHub Advisory Database

    Fix available

    jose fixed in 1.11.13

  2. Oct 26, 2026 · Trivy Vulnerability DB

    Detected

    Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (jose_jwa_x25519:curve25519/2) whose clauses branch on individual bits of the clamp

  3. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    jose fixed in 1.11.13

  4. Oct 27, 2026 · Trivy Vulnerability DB

    Updated

    Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursive Montgomery ladder (jose_jwa_x25519:curve25519/2) whose clauses branch on individual bits of the clamp

Sources

  • CVE.orgVulnerability recordCVE-2026-65630

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-xvr2-gggj-h2pp

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryEEF-CVE-2026-65630

    Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

    osv.dev
  • Trivy Vulnerability DBPackage advisoryDEBIAN-CVE-2026-65630

    Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 30, 2026
  • OpenSSF OSV / OSV ScannerOct 30, 2026
  • CVE.orgOct 27, 2026
  • Trivy Vulnerability DBOct 27, 2026