Andrew Bennett

ECDSA signature length is not validated in jose, allowing signature malleability

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

Weak PBKDF2 parameters for password-encrypted private-key export in jose

Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose