CVE-2026-116587 Go JOSE: DoS when parsing JWKs that contain RSA keys

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

CVE-2026-116587

The go-jose library (prior to version 4.1.6 ) is vulnerable to a Remote Denial of Service (DoS) due to inefficient algorithmic complexity. When parsing JSON Web Keys (JWKs) from untrusted sources, the library fails to enforce size and consistency bounds on RSA modulus and prime values before pass...