Vulnerabilities

TI-2026-80925 CVE-2026-116587 · GHSA-mgcc-cww5-fp2q

Denial of service in go-jose when parsing JWKs with RSA keys

LOW 39

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00366 Published 2026-10-26 Partial fix · 4.1.6 CWE-407

TI-2026-80924 CVE-2026-116586 · GHSA-vvm8-gf78-28g4

Go JOSE: Panics in JSON parsing

LOW 36

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00292 Published 2026-10-26 Partial fix · 4.1.5 CWE-674

TI-2026-80923 CVE-2026-116585 · GHSA-4w3g-jfj2-cw2q

Panic in Go JOSE CBC-HMAC decryption enables denial of service

LOW 36

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00264 Published 2026-10-26 Partial fix · 4.1.5 CWE-129

TI-2025-20001 CVE-2025-27144 · GHSA-c6gw-w398-hv78

Go JOSE's Parsing Vulnerable to Denial of Service

LOW 35

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00399 Published 2025-02-24 Partial fix · 4.0.5, 3.0.4 CWE-770

Vulnerabilities

Filters

Denial of service in go-jose when parsing JWKs with RSA keys

Go JOSE: Panics in JSON parsing

Panic in Go JOSE CBC-HMAC decryption enables denial of service

Go JOSE's Parsing Vulnerable to Denial of Service