CVE-2026-65632

A flaw was found in jose. When verifying Elliptic Curve Digital Signature Algorithm ECDSA signatures, the library does not enforce fixed signature lengths and ignores leading zero bytes. An attacker with a valid token can alter the signature format while keeping it cryptographically valid, causin...

CVE-2026-65630

A flaw was found in jose. The pure-Erlang fallback implementation of the X25519 cryptographic algorithm performs operations whose execution times vary depending on the secret key. An attacker capable of submitting encrypted messages and measuring decryption response times can exploit this timing...

CVE-2026-65629

A flaw was found in jose. This vulnerability may lead to information disclosure because the library uses insufficiently strong key derivation parameters when exporting password-encrypted private keys. The export process relies on a hardcoded, low iteration count and a short cryptographic salt...

CVE-2026-65626

A flaw was found in the jose library. The fallback RSA decryption mechanism reveals whether decrypted data has valid padding through distinguishable error responses and timing discrepancies. An unauthenticated attacker can exploit this vulnerability by submitting a series of specially crafted...

CVE-2026-65625

A flaw was found in jose. In environments where the pure-Erlang fallback is used for Advanced Encryption Standard Galois/Counter Mode AES-GCM decryption, the software determines the number of verification bits directly from the user-provided authentication tag rather than enforcing a standard...

CLEANSTART-2026-KZ66366 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the restic package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2026-CP16245 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the restic package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CVE-2026-65631

A flaw was found in jose. An unauthenticated remote attacker can exploit this vulnerability to cause a Denial of Service DoS by submitting a specially crafted JSON Web Key JWK. When processing an RSA key that lacks certain mathematical parameters, the library attempts to calculate the missing...

CVE-2026-65628

A flaw was found in jose. This flaw allows an attacker to cause a Denial of Service DoS by triggering an infinite loop during cryptographic key derivation. When deriving a shared secret, passing two JSON Web Keys JWKs with mismatched key types causes the sharedsecret function to enter unbounded...

CLEANSTART-2026-ZY17213 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-116585 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerabilit...

CLEANSTART-2026-HB11422 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-116587 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerabilit...

CLEANSTART-2026-EQ07538 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-116586 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerabilit...

ROOT-APP-GOBINARY-CVE-2026-116587 CVE-2026-116587 in github.com/go-jose/go-jose/v4 - Patched by Root

Root has patched CVE-2026-116587 in the github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-34986 CVE-2026-34986 in github.com/go-jose/go-jose/v4 - Patched by Root

Root has patched CVE-2026-34986 in the github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available...

CLEANSTART-2026-WP21635 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-116585 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerabilit...

CLEANSTART-2026-WE07714 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-116586 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerabilit...

CLEANSTART-2026-OI48555 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-116587 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerabilit...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via HMACKey and CryptographyHMACKey, which accept zero-length HMAC secrets. When an application's HS256, HS384, or HS512 verification key resolves to empty - for example, an oct JWK with ...

CVE-2026-120459

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK wit...

CVE-2026-120459 python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key

python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key resolves to empty, such as an oct JWK wit...