Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by GitHub_M

CVE-2026-116586Go JOSE: Panics in JSON parsing

Medium 6.9

In plain English

A medium-severity security flaw in go-jose from go-jose. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 78.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13golang-github-go-jose-go-joseno fix listedDEBIAN-CVE-2026-116586
Debian:14golang-github-go-jose-go-joseno fix listedDEBIAN-CVE-2026-116586
Debian:13golang-github-go-jose-go-jose.v3no fix listedDEBIAN-CVE-2026-116586
Debian:14golang-github-go-jose-go-jose.v3no fix listedDEBIAN-CVE-2026-116586
Debian:12golang-gopkg-square-go-jose.v1no fix listedDEBIAN-CVE-2026-116586
Debian:13golang-gopkg-square-go-jose.v1no fix listedDEBIAN-CVE-2026-116586
Debian:14golang-gopkg-square-go-jose.v1no fix listedDEBIAN-CVE-2026-116586
Debian:12golang-gopkg-square-go-jose.v2no fix listedDEBIAN-CVE-2026-116586
Debian:13golang-gopkg-square-go-jose.v2no fix listedDEBIAN-CVE-2026-116586
Debian:14golang-gopkg-square-go-jose.v2no fix listedDEBIAN-CVE-2026-116586
Gogithub.com/go-jose/go-jose/v3no fix listedGHSA-vvm8-gf78-28g4
Gogithub.com/go-jose/go-jose/v44.1.5GHSA-vvm8-gf78-28g4
Ubuntu:24.04:LTSgolang-github-go-jose-go-joseno fix listedUBUNTU-CVE-2026-116586
Ubuntu:26.10golang-github-go-jose-go-joseno fix listedUBUNTU-CVE-2026-116586
Ubuntu:26.04:LTSgolang-github-go-jose-go-jose.v3no fix listedUBUNTU-CVE-2026-116586
Ubuntu:26.10golang-github-go-jose-go-jose.v3no fix listedUBUNTU-CVE-2026-116586
Ubuntu:22.04:LTSgolang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116586
Ubuntu:24.04:LTSgolang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116586
Ubuntu:26.04:LTSgolang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116586
Ubuntu:26.10golang-gopkg-square-go-jose.v2no fix listedUBUNTU-CVE-2026-116586

Affected products (as reported)

VendorProductVersions
go-jose go-jose < 4.1.5

Weakness: CWE-674 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References