Improper access control in Go JOSE All versions before 1.0.4
Priority LOW 37CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
Why it matters now
EPSS 0.01969 80th percentileScored 2026-11-07
Fix Fixed gopkg.in/square/go-jose.v1 (Go): 1.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Go JOSE All versions before 1.0.4 | Go JOSE All versions before 1.0.4 | — | No fix listed | CNA |
| — | gopkg.in/square/go-jose.v1 (Go) | before 1.1.0 | 1.1.0 | Patch available | GHSA-77gc-fj98-665h |
- Go JOSE All versions before 1.0.4 Vendor— Affected Go JOSE All versions before 1.0.4 Fixed in — No fix listed CNA
- gopkg.in/square/go-jose.v1 (Go) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-77gc-fj98-665h
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:* | up to 1.0.3 | Vulnerable | Go-jose Project |
- cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:* Versions up to 1.0.3 Vulnerable ·Go-jose Project
Remediation
- Fix · GHSA-77gc-fj98-665h gopkg.in/square/go-jose.v1 (Go) Fixed in 1.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-9122
- 2026-10-03 Alias added: GHSA-77gc-fj98-665h
References
Patch 2
Other 6
- https://hackerone.com/reports/169629
- https://github.com/square/go-jose/pull/111
- https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96
- https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507
- https://github.com/square/go-jose
- https://www.openwall.com/lists/oss-security/2016/11/03/1
More Go-jose Project Go-jose vulnerabilities
- TI-2016-07468 go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. CVSS 3.0CRITICAL 9.1
- TI-2026-27208 Go JOSE affect by a panic in JWE decryption CVSS 3.1HIGH 7.5
- TI-2016-07470 Integer overflow in Go JOSE All versions before 1.0.5 CVSS 3.0HIGH 7.5
- TI-2024-18756 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) CVSS 3.1MEDIUM 4.3
Sources
- CVE-2016-9122 · CVE Program
- CVE-2016-9122 · NVD
- FIRST EPSS
- GHSA-77gc-fj98-665h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences