erlang-jose EUVD-2026-110303

Requires a deployment where Erlang/OTP does not expose a native AES-GCM crypto NIF, so JOSE routes GCM through the jose_jwa_aes pure-Erlang fallback - explicitly FIPS builds, or stripped/older OTP builds; on standard OTP where :crypto provides AES-GCM the fallback is not reached and the flaw is not triggered. The victim service must decrypt attacker-influenced JWE tokens using AES-GCM content encryption (A128/192/256GCM) or AEAD key wrapping (A*GCMKW) via the public JOSE.JWE.block_decrypt / block_decrypt/4 path. No authentication is required (PR:N) and no user interaction. The principal limiting factor is the non-default fallback condition: the forgery (and the over-length-tag process crash) only occurs when native GCM is absent; affected versions are jose 1.2.0 up to but excluding 1.11.13.

Signals point to a genuine but conditional integrity flaw rather than a mass-exploitation emergency. The CVSS 4.0 base score is 5.9 (medium) with VI:H (authentication-tag forgery / integrity bypass) but VC:N and only VA:L, and critically AT:P - exploitation requires the pure-Erlang AES-GCM fallback to be active, which only happens when Erlang/OTP exposes no native AES-GCM NIF (FIPS, stripped, or older OTP builds). EPSS is very low at 0.11% (2nd percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation; a low EPSS combined with a published, self-verifying PoC is consistent with a credible-but-not-yet-exploited library bug. The vuln.today decision label is 'this_month', i.e. a patch-promptly item, not act_now/emergency. Note a discrepancy in attack vector: the authoritative vector is AV:L, yet the advisory threat model is an unauthenticated outside attacker submitting JWE compact tokens to a decrypt endpoint, which reads as network-reachable (AV:N) in most real deployments - verify how tokens reach the service before downgrading reachability. Net: real priority only for Erlang/Elixir deployments that both decrypt attacker-influenced JWE and run without native AES-GCM; elsewhere the vulnerable fallback path is not reached and real risk is low.

An unauthenticated attacker submits a crafted JWE compact token (dir/A256GCM) to a victim service that decrypts attacker-supplied tokens via the public JOSE.JWE.block_decrypt path, on a host where GCM falls back to jose_jwa_aes (no native crypto NIF). The attacker truncates the GCM authentication tag to a single byte and brute-forces the 256 possible values; because only 8 bits of the real 128-bit tag are ever compared, exactly one forged ciphertext is accepted as authentic within 256 attempts without knowledge of the key. A complete, self-verifying proof-of-concept exploit script is published in the vendor's GHSA advisory.