CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

CVE-2026-116585

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...

ROOT-APP-GOBINARY-CVE-2026-34986 CVE-2026-34986 in github.com/go-jose/go-jose/v4 - Patched by Root

Root has patched CVE-2026-34986 in the github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-116587 CVE-2026-116587 in github.com/go-jose/go-jose/v4 - Patched by Root

Root has patched CVE-2026-116587 in the github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available...

GHSA-VVM8-GF78-28G4 Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

EUVD-2026-110466

Go JOSE: Panics in JSON parsing...

Go JOSE: Panics in JSON parsing

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JS...

GHSA-4W3G-JFJ2-CW2Q Go JOSE: Panic during CBC-HMAC processing

Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Details Insufficient validation of parameters can lead ...

EUVD-2026-110465

Go JOSE: Panic during CBC-HMAC processing...

Go JOSE: Panic during CBC-HMAC processing

Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Details Insufficient validation of parameters can lead ...

CVE-2026-116587

A flaw was found in go-jose. A remote attacker can cause a Denial of Service DoS by supplying a crafted JSON Web Key JWK with oversized or degenerate RSA cryptographic parameters. Because the library fails to enforce size and consistency bounds prior to validation, processing these malicious keys...

CVE-2026-116586

A flaw was found in go-jose. A remote attacker could cause a Denial of Service DoS by submitting specially crafted, deeply nested JSON JavaScript Object Notation input to an affected application. When parsing these deeply nested arrays or objects, the system exceeds its stack memory limits,...

CVE-2026-116585

A flaw was found in go-jose. Insufficient input validation during the decryption of untrusted JSON Web Encryption JWE ciphertext allows an empty buffer to be indexed during CBC-HMAC unpadding. A remote attacker can exploit this flaw by providing crafted ciphertext, triggering an application panic...

SUSE CVE-2026-116585

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...

SUSE CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

go-jose JWE DoS

The vulnerability in the Go implementation of JWE, JWS, and JWT go-jose is related to unrestricted resource allocation and regulation. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-116587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON W...

Linux Distros Unpatched Vulnerability : CVE-2026-116585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON W...

Linux Distros Unpatched Vulnerability : CVE-2026-116586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON W...