Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by GitHub_M

CVE-2026-116585Go JOSE: Panic during CBC-HMAC processing

Medium 6.9

In plain English

A medium-severity security flaw in go-jose from go-jose. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 81.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13golang-github-go-jose-go-joseno fix listedDEBIAN-CVE-2026-116585
Debian:14golang-github-go-jose-go-joseno fix listedDEBIAN-CVE-2026-116585
Debian:13golang-github-go-jose-go-jose.v3no fix listedDEBIAN-CVE-2026-116585
Debian:14golang-github-go-jose-go-jose.v3no fix listedDEBIAN-CVE-2026-116585
Debian:12golang-gopkg-square-go-jose.v1no fix listedDEBIAN-CVE-2026-116585
Debian:13golang-gopkg-square-go-jose.v1no fix listedDEBIAN-CVE-2026-116585
Debian:14golang-gopkg-square-go-jose.v1no fix listedDEBIAN-CVE-2026-116585
Debian:12golang-gopkg-square-go-jose.v2no fix listedDEBIAN-CVE-2026-116585
Debian:13golang-gopkg-square-go-jose.v2no fix listedDEBIAN-CVE-2026-116585
Debian:14golang-gopkg-square-go-jose.v2no fix listedDEBIAN-CVE-2026-116585
Gogithub.com/go-jose/go-jose/v3no fix listedGHSA-4w3g-jfj2-cw2q
Gogithub.com/go-jose/go-jose/v44.1.5GHSA-4w3g-jfj2-cw2q
Ubuntu:24.04:LTSgolang-github-go-jose-go-joseno fix listedUBUNTU-CVE-2026-116585
Ubuntu:26.10golang-github-go-jose-go-joseno fix listedUBUNTU-CVE-2026-116585
Ubuntu:26.04:LTSgolang-github-go-jose-go-jose.v3no fix listedUBUNTU-CVE-2026-116585
Ubuntu:26.10golang-github-go-jose-go-jose.v3no fix listedUBUNTU-CVE-2026-116585
Ubuntu:22.04:LTSgolang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116585
Ubuntu:24.04:LTSgolang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116585
Ubuntu:26.04:LTSgolang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116585
Ubuntu:26.10golang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116585

Affected products (as reported)

VendorProductVersions
go-jose go-jose < 4.1.5

Weakness: CWE-129 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References