ROOT-APP-GOBINARY-CVE-2026-116587 CVE-2026-116587 in github.com/go-jose/go-jose/v4 - Patched by Root

Root has patched CVE-2026-116587 in the github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the CBC-HMAC decryption process. An attacker can cause a panic and disrupt service availability by submitting specially crafted ciphertext that results in an empty buffer being passed to the unpaddi...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the CBC-HMAC decryption process. An attacker can cause a panic and disrupt service availability by submitting specially crafted ciphertext that results in an empty buffer being passed to the unpaddi...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index in the CBC-HMAC decryption process. An attacker can cause a panic and disrupt service availability by submitting specially crafted ciphertext that results in an empty buffer being passed to the unpaddi...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation Upgrade github.com/go-jose/go-jose/v4/json t...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation There is no fixed version for...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the JSON parsing process. An attacker can cause the application to crash by submitting deeply nested arrays or objects, leading to stack exhaustion. Remediation There is no fixed version for...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parsing process of JWKs containing RSA keys due to lack of size and consistency checks on RSA modulus and prime values before validation. An attacker can cause excessive CPU consumption and...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the parsing process of JWKs containing RSA keys due to lack of size and consistency checks on RSA modulus and prime values before validation. An attacker can cause excessive CPU consumption and...

Rocky Linux 8 [CIQ] Security Update: aardvark-dns / buildah / buildah-debuginfo / buildah-debugsource / etc Multiple Vulnerabilities (crlsa-2024_3254)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243254 advisory. buildah: full container escape at build time CVE-2024-1753 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters...

Rocky Linux 8 [CIQ] Security Update: aardvark-dns / buildah / buildah-debuginfo / buildah-debugsource / etc Multiple Vulnerabilities (crlsa-2024_3968)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243968 advisory. podman: jose-go: improper handling of highly compressed data CVE-2024-28180 buildah: jose-go: improper handling of highly compressed data CVE-2024-28180...

Rocky Linux 9 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2024_2549)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242549 advisory. golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2024_3826)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243826 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2024_3827)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243827 advisory. golang: net/http: memory exhaustion in Request.ParseMultipartForm CVE-2023-45290 jose-go: improper handling of highly compressed data CVE-2024-28180 builda...

RHCOS 4 : OpenShift Container Platform 4.12.57 (RHSA-2024:2784)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2784 advisory. - buildah: full container escape at build time CVE-2024-1753 - cri-o: Arbitrary command injection via pod annotation CVE-2024-3154 -...

RHCOS 4 : OpenShift Container Platform 4.13.41 (RHSA-2024:2049)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2049 advisory. - golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45288 - buildah: full container escape ...

RHCOS 4 : OpenShift Container Platform 4.15.11 (RHSA-2024:2071)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2071 advisory. - jose-go: improper handling of highly compressed data CVE-2024-28180 Note that Nessus has not tested for this issue but has instead relied...

RHCOS 4 : OpenShift Container Platform 4.12.58 (RHSA-2024:3351)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3351 advisory. - jose-go: improper handling of highly compressed data CVE-2024-28180 Note that Nessus has not tested for this issue but has instead relied...

MiracleLinux 9 : skopeo-1.14.3-2.el9 (AXSA:2024-8078:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8078:02 advisory. golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.15.35 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.35 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...