go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm.
Priority MEDIUM 42CWE-326Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-326.
Summary
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
Why it matters now
EPSS 0.01411 72nd percentileScored 2026-11-07
Fix Fixed gopkg.in/square/go-jose.v1 (Go): 1.0.4github.com/square/go-jose (Go): 1.0.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Go JOSE All versions before 1.0.4 | Go JOSE All versions before 1.0.4 | — | No fix listed | CNA |
| — | gopkg.in/square/go-jose.v1 (Go) | before 1.0.4 | 1.0.4 | Patch available | GHSA-86r9-39j9-99wp |
| — | github.com/square/go-jose (Go) | before 1.0.4 | 1.0.4 | Patch available | GHSA-86r9-39j9-99wp |
- Go JOSE All versions before 1.0.4 Vendor— Affected Go JOSE All versions before 1.0.4 Fixed in — No fix listed CNA
- gopkg.in/square/go-jose.v1 (Go) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-86r9-39j9-99wp
- github.com/square/go-jose (Go) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-86r9-39j9-99wp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:* | up to 1.0.3 | Vulnerable | Go-jose Project |
- cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:* Versions up to 1.0.3 Vulnerable ·Go-jose Project
Remediation
- Fix · GHSA-86r9-39j9-99wp gopkg.in/square/go-jose.v1 (Go) Fixed in 1.0.4 Advisory →
- Fix · GHSA-86r9-39j9-99wp github.com/square/go-jose (Go) Fixed in 1.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-9121
- 2026-10-03 Alias added: GHSA-86r9-39j9-99wp
References
Patch 2
More Go-jose Project Go-jose vulnerabilities
- TI-2026-27208 Go JOSE affect by a panic in JWE decryption CVSS 3.1HIGH 7.5
- TI-2016-07470 Integer overflow in Go JOSE All versions before 1.0.5 CVSS 3.0HIGH 7.5
- TI-2016-07469 Improper access control in Go JOSE All versions before 1.0.4 CVSS 3.0HIGH 7.5
- TI-2024-18756 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) CVSS 3.1MEDIUM 4.3
Sources
- CVE-2016-9121 · CVE Program
- CVE-2016-9121 · NVD
- FIRST EPSS
- GHSA-86r9-39j9-99wp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences