EUVD-2026-110467

Go JOSE: DoS when parsing JWKs that contain RSA keys...

CVE-2026-116587

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

CVE-2026-116586

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

CVE-2026-116585

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...

CVE-2026-116587

The go-jose library (prior to version 4.1.6 ) is vulnerable to a Remote Denial of Service (DoS) due to inefficient algorithmic complexity. When parsing JSON Web Keys (JWKs) from untrusted sources, the library fails to enforce size and consistency bounds on RSA modulus and prime values before pass...

CVE-2026-116587 Go JOSE: DoS when parsing JWKs that contain RSA keys

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from...

EUVD-2026-110466

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

CVE-2026-116586

The go-jose library, which implements Javascript Object Signing and Encryption standards (JWE, JWS, JWT) in Go, is vulnerable to a stack overflow. Prior to version 4.1.5 , parsing attacker-controlled JSON with deeply nested arrays or objects can exceed Go's stack limit, causing the application to...

CVE-2026-116586 Go JOSE: Panics in JSON parsing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

CVE-2026-116585

The Go JOSE library (prior to version 4.1.5 ) is vulnerable to a denial of service due to a panic during CBC-HMAC processing. When decrypting untrusted JWE ciphertext using the A128CBC-HS256 , A192CBC-HS384 , or A256CBC-HS512 content-encryption algorithms, the system may pass an empty ciphertext ...

EUVD-2026-110465

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...

CVE-2026-116585 Go JOSE: Panic during CBC-HMAC processing

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384...

ROOT-APP-GOBINARY-CVE-2026-34986 CVE-2026-34986 in github.com/go-jose/go-jose/v4 - Patched by Root

Root has patched CVE-2026-34986 in the github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available...

CLEANSTART-2026-XM93571 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-34986 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerability...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791280549)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791280549 advisory. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791280549)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791280549 advisory. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for...

CLEANSTART-2026-PU41775 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-34986 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerability...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

AlmaLinux 9.2 [TuxCare] Security Update: podman / podman-docker / podman-gvproxy / podman-plugins / etc (ALMALINUX9.2:CLSA-2025:1766596893)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1766596893 advisory. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2025_7389)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257389 advisory. go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-27144 Tenable has extracted the preceding description block directly from the CIQ security...