CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

Go JOSE: DoS When Parsing JWKs That Contain RSA Keys

Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to "crypto/rsa.PrivateKey.Validate". On Go 1.24+, this takes cubic time...

GHSA-MGCC-CWW5-FP2Q Go JOSE: DoS when parsing JWKs that contain RSA keys

Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate. On Go 1.24+, this takes cubic time complexit...

CVE-2026-116587 Go JOSE: DoS when parsing JWKs that contain RSA keys

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

CVE-2026-116587 Go JOSE: DoS when parsing JWKs that contain RSA keys

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

CVE-2026-116587

The go-jose library (prior to version 4.1.6 ) is vulnerable to a Remote Denial of Service (DoS) due to inefficient algorithmic complexity. When parsing JSON Web Keys (JWKs) from untrusted sources, the library fails to enforce size and consistency bounds on RSA modulus and prime values before pass...

CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

CVE-2026-116587 Go JOSE: DoS when parsing JWKs that contain RSA keys

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

PT-2026-125465

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 4.1.6 Description The software parses attacker-controlled RSA modulus and prime values from JSON Web Keys JWKs without enforcing size and consistency bounds before passing them to the crypto/rsa.PrivateKey.Validate...