# CVE-2026-65629: Weak PBKDF2 parameters for password-encrypted private-key export in jose

Status: published. Published: 2026-10-26. Updated: 2026-11-02.

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack.

When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller.

Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key.

This issue affects jose: from 1.10.0 before 1.11.13.

## Remediation

- workaround: When exporting a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), use a long, high-entropy passphrase, since the weak key-derivation work factor only meaningfully lowers the cost of cracking guessable passwords. Restrict access to exported EncryptedPrivateKeyInfo blobs and keep them out of backups, repositories, object storage, and logs that an attacker could read. (source: CNA: EEF)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0

## Affected products and versions

- potatosalad / jose (jose): ≥ 1.10.0; < 1.11.13 (affected, semver). Source: CNA: EEF
- potatosalad / jose (potatosalad/erlang-jose): ≥ 85fddd89ee56b6f9c19eff7d9cfffeef62c330b9; < 461b261902531ca016190e780bb70862d561a7e0 (affected, git). Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 7.4 (high); CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: EEF

- CVSS 4.0: 7.4 (high); CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

- CISA KEV: No listing in collected sources

- EPSS: 0.06% as of 2026-11-02; percentile 0.01%

- SSVC: exploitation poc; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-916

## Exploit evidence

- exploit: https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc (ADP: CISA-ADP)

## References

- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc (CNA: EEF; vendor-advisory, related)

- https://cna.erlef.org/cves/CVE-2026-65629.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-65629 (CNA: EEF; related)

- https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9 (CNA: EEF; related)

- https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0 (CNA: EEF; patch)

- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc (ADP: CISA-ADP; exploit)

- https://cna.erlef.org/cves/CVE-2026-65629.html (6b3ad84c-e1a6-4bf7-a703-f496b71e49db)

- https://github.com/potatosalad/erlang-jose/commit/461b261902531ca016190e780bb70862d561a7e0 (6b3ad84c-e1a6-4bf7-a703-f496b71e49db)

- https://github.com/potatosalad/erlang-jose/commit/85fddd89ee56b6f9c19eff7d9cfffeef62c330b9 (6b3ad84c-e1a6-4bf7-a703-f496b71e49db)

- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc (6b3ad84c-e1a6-4bf7-a703-f496b71e49db)

- https://osv.dev/vulnerability/EEF-CVE-2026-65629 (6b3ad84c-e1a6-4bf7-a703-f496b71e49db)

- https://github.com/potatosalad/erlang-jose/security/advisories/GHSA-h4gx-8jq2-mfhc (134c704f-9b21-4f2e-91b3-4a467353bcc0)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-65629; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65629; retrieved 2026-11-03; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-65629; retrieved 2026-11-02; source updated Not reported

Revision: 203903a64bf5b1bb02b97d697809befc33a9696dbe77de76a99e9cdd5be77cdc

Canonical: https://y2.dev/cve/CVE-2026-65629

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.