erlang-jose CVE-2026-65631

The vulnerable path is reached only when an application parses an UNTRUSTED JWK through the public jose_jwk:from_binary/1 or jose_jwk:from_map/1 APIs (or Elixir JOSE.JWK.from_binary/1 / from_map/1) - for example accepting a client-supplied key or a JWK Set over an HTTP boundary. The triggering input is specifically an RSA private key that supplies d, e, and n but omits ALL CRT parameters (p, q, dp, dq, qi); this exact combination routes from_map_rsa_private_key/2 into convert_sfm_to_crt/1, and the three integers are read from base64url and never validated as a real RSA key (a prime modulus makes the factoring search never succeed). No credentials, no valid RSA key, and no special configuration are required. LIMITING FACTORS: the application must actually expose these parsing APIs to attacker-controlled input (a service that never parses untrusted private RSA JWKs is not reachable); and an internal 1-second watchdog caps each single request, so sustained denial of service requires flooding many concurrent requests rather than one.

Signals are consistent in pointing to a moderate, availability-only issue rather than a top-tier emergency. The vendor CVSS 4.0 score is 6.9 (Medium) with VA:H but VC:N/VI:N - pure CPU-exhaustion DoS, no confidentiality or integrity impact. EPSS is low (0.24%, 14th percentile) and the CVE is NOT in CISA KEV, indicating no evidence of active or widespread exploitation. However, a working proof-of-concept exploit script is published in the vendor GHSA advisory with verified logs showing ~1009 ms of CPU burned by a single 211-byte request, so weaponization is trivial and already demonstrated - do not treat POC availability as equivalent to active exploitation. The vuln.today decision label is 'this_month', aligning with a prompt-but-not-crisis posture. A key CONFLICT: the vendor CVSS vector specifies AV:L (local), yet the description and advisory explicitly describe an unauthenticated REMOTE attacker submitting a crafted JWK over an HTTP trust boundary (e.g., a client-supplied key or JWK Set) - the local vector appears to understate reach and should be verified; this analysis independently assesses the vector as AV:N. Net: a genuine, easily-exploitable DoS worth patching this cycle for any service parsing untrusted JWKs, but not a data-breach-grade, drop-everything event.

An application exposes an endpoint that parses client-supplied or federation JWKs (e.g., a JWK Set) via JOSE.JWK.from_binary/1 or from_map/1. An unauthenticated attacker submits a few-hundred-byte RSA JWK containing n, e, and d but no CRT parameters, where n is a prime, forcing the library into a never-terminating prime-recovery factoring loop that consumes nearly a full CPU-second before a 1-second watchdog kills the worker. By flooding such tiny requests the attacker pins every BEAM scheduler at 100% and denies service to legitimate traffic; a public, verified PoC script for the amplification is included in the vendor advisory.