Go-Jose
Vulnerability activity for Go-Jose: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.5HighOct 26, 2026go-joseCVE-2026-116587### Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. ### Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to `crypto/rsa.PrivateKey.Validate()`. On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU. https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4
- 5.5MediumOct 26, 2026go-jose Denial of serviceCVE-2026-116586### Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. ### Impact Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed. ### Workarounds Reject large inputs before parsing them. ### Acknowledgements Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho fo
- 5.5MediumOct 26, 2026go-joseCVE-2026-116585### Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. ### Details Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292. ### Workarounds If the application does not require the CBC-HMAC modes for content encryption,
Top products
- go-jose3 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.