erlang-jose EUVD-2026-110304

Requires an application that (1) uses jose to unwrap RSA1_5 JWE keys or otherwise calls decrypt_private/3 with rsa_pkcs1_padding, and (2) exposes the decryption outcome across a trust boundary - a distinguishable return value/error (binary key vs. error/{error,{badsize,_}}) or observable response timing. For the direct return-value oracle the pure-Erlang jose_jwa_pkcs1 implementation must be the active backend (e.g. JOSE.crypto_fallback(true) or routing that pins RSA1_5 to it); the PoC explicitly forced this because OTP otherwise selects native RSA. The attacker needs only the public RSA key (no authentication). LIMITING FACTORS: the application must accept the RSA1_5 algorithm (choosing RSA-OAEP/RSA-OAEP-256 or rejecting RSA1_5 at the protected header avoids it); the attack is adaptive chosen-ciphertext requiring roughly 10^4-10^6 queries, so per-client rate-limiting of decryption failures materially raises cost; even with error-value normalization the non-blinded crypto:mod_pow modexp leaves a measurable timing oracle. Affected: jose 1.3.0 through before 1.11.13.

This is a genuine cryptographic weakness but a moderate real-world priority, not a drop-everything emergency. Signals are internally consistent on the low-to-moderate end: CVSS 5.9 (medium), EPSS 0.09% (0th percentile), no CISA KEV listing, and a vendor-assigned decision label of 'this_month'. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H) scores confidentiality-only impact, no authentication (public key suffices), but adds AT:P to reflect that exploitation is conditional and non-trivial. There is a notable conflict worth flagging: the vendor chose AV:L (local), yet the description explicitly says an unauthenticated attacker submits ciphertexts to a 'decryption endpoint' - i.e. a network vector (AV:N); the AV:L choice likely reflects the surviving timing side channel rather than the primary return-value oracle, and should be verified against the actual deployment. The attack is real and well-understood (classic Bleichenbacher / Marvin-style), a public PoC demonstrates the distinguisher, and successful exploitation fully recovers plaintext - but it requires an application that both uses jose's RSA1_5 JWE unwrapping and exposes decryption outcomes across a trust boundary, plus roughly 10^4-10^6 adaptive chosen-ciphertext queries. The low EPSS and absence of KEV indicate no observed widespread exploitation, consistent with a targeted, high-effort attack rather than mass scanning. Prioritize patching where RSA1_5 JWE unwrapping is actually exposed; it is a lower priority where RSA1_5 is unused or the pure-Erlang backend is not routed.

An application uses erlang-jose to unwrap RSA1_5-wrapped JWE content-encryption keys at a network-reachable endpoint and reveals (via return value, error channel, or observable timing) whether a decryption had conforming PKCS#1 v1.5 padding. An unauthenticated attacker holding only the server's public RSA key submits on the order of 10^4-10^6 crafted ciphertexts, using each accept/reject answer as a one-bit padding oracle to run Bleichenbacher's adaptive attack and recover the plaintext content-encryption key (and thus the protected message) of an intercepted ciphertext, or to forge a signature. A public PoC in the GHSA advisory demonstrates the distinguishable padding oracle (it proves the one-bit signal, not a full attack implementation).