TI-2016-07468 CVE-2016-9121 · GHSA-86r9-39j9-99wp
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm.
Priority MEDIUM 42
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm.
Go-jose Project
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Go-jose Project records in CISA KEVNo Go-jose Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2016-07470 CVE-2016-9123 · GHSA-3fx4-7f69-5mmg
Integer overflow in Go JOSE All versions before 1.0.5
Priority LOW 37
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures.
TI-2016-07469 CVE-2016-9122 · GHSA-77gc-fj98-665h
Improper access control in Go JOSE All versions before 1.0.4
Priority LOW 37
go-jose before 1.0.4 suffers from multiple signatures exploitation.
TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Priority LOW 26
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.