Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-34986Go JOSE affect by a panic in JWE decryption

High 7.5

In plain English

A high-severity security flaw in go-jose from go-jose. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 48.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:35833
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3901+4b80ecd7	ALSA-2026:33722
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+4047+545787c4	ALSA-2026:33722
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+4089+ce72bbbe	ALSA-2026:33722
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:33722
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+3901+4b80ecd7	ALSA-2026:35833
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+4047+545787c4	ALSA-2026:35833
AlmaLinux:8	aardvark-dns	2:1.10.1-2.module_el8.10.0+4089+ce72bbbe	ALSA-2026:35833
AlmaLinux:8	buildah	2:1.33.14-4.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:8	buildah	2:1.33.14-3.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:9	buildah	2:1.41.8-3.el9_7	ALSA-2026:10135
AlmaLinux:9	buildah	2:1.43.1-1.el9_8	ALSA-2026:19186
AlmaLinux:8	buildah-tests	2:1.33.14-3.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	buildah-tests	2:1.33.14-3.module_el8.10.0+4136+16425343	ALSA-2026:33722
AlmaLinux:8	buildah-tests	2:1.33.14-4.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:9	buildah-tests	2:1.41.8-3.el9_7	ALSA-2026:10135
AlmaLinux:9	buildah-tests	2:1.43.1-1.el9_8	ALSA-2026:19186
AlmaLinux:8	cockpit-podman	84.1-1.module_el8.10.0+4102+6c76e544	ALSA-2026:35833
AlmaLinux:8	cockpit-podman	84.1-1.module_el8.10.0+4102+6c76e544	ALSA-2026:33722
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+4090+91932338	ALSA-2026:35833
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3970+8445edf6	ALSA-2026:35833
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+3970+8445edf6	ALSA-2026:33722
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+4068+0e21408f	ALSA-2026:35833
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+4090+91932338	ALSA-2026:33722
AlmaLinux:8	conmon	3:2.1.10-1.module_el8.10.0+4068+0e21408f	ALSA-2026:33722
AlmaLinux:8	container-selinux	2:2.229.0-3.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	container-selinux	2:2.229.0-3.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:8	containernetworking-plugins	1:1.4.0-8.module_el8.10.0+4136+16425343	ALSA-2026:35833
AlmaLinux:8	containernetworking-plugins	1:1.4.0-8.module_el8.10.0+4136+16425343	ALSA-2026:33722
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3876+e55593a8	ALSA-2026:33722
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3901+4b80ecd7	ALSA-2026:33722
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3876+e55593a8	ALSA-2026:35833
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+4089+ce72bbbe	ALSA-2026:33722
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+3901+4b80ecd7	ALSA-2026:35833
AlmaLinux:8	containers-common	2:1-82.module_el8.10.0+4089+ce72bbbe	ALSA-2026:35833
AlmaLinux:8	crit	3.18-5.module_el8.10.0+4047+545787c4	ALSA-2026:33722
AlmaLinux:8	crit	3.18-5.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	crit	3.18-5.module_el8.10.0+4047+545787c4	ALSA-2026:35833
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2026:35833
AlmaLinux:8	crit	3.18-5.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3845+87b84552	ALSA-2026:33722
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2026:33722
AlmaLinux:8	crit	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2026:35833
AlmaLinux:8	criu	3.18-5.module_el8.10.0+4089+ce72bbbe	ALSA-2026:35833
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2026:33722
AlmaLinux:8	criu	3.18-5.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:33722
AlmaLinux:8	criu	3.18-5.module_el8.10.0+4089+ce72bbbe	ALSA-2026:33722
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2026:35833
AlmaLinux:8	criu	3.18-5.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	criu	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:35833
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+4016+efd18bf8	ALSA-2026:33722
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+4068+0e21408f	ALSA-2026:35833
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+4016+efd18bf8	ALSA-2026:35833
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+4089+ce72bbbe	ALSA-2026:33722
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2026:33722
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+3858+6ad51f9f	ALSA-2026:35833
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+4068+0e21408f	ALSA-2026:33722
AlmaLinux:8	criu-devel	3.18-5.module_el8.10.0+4089+ce72bbbe	ALSA-2026:35833
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3970+8445edf6	ALSA-2026:35833
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3926+f12484f5	ALSA-2026:33722
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+4082+f7f0c95e	ALSA-2026:33722
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:33722
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3970+8445edf6	ALSA-2026:33722
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:35833
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+4082+f7f0c95e	ALSA-2026:35833
AlmaLinux:8	criu-libs	3.18-5.module_el8.10.0+3926+f12484f5	ALSA-2026:35833
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+4082+f7f0c95e	ALSA-2026:33722
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+4102+6c76e544	ALSA-2026:33722
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+4102+6c76e544	ALSA-2026:35833
AlmaLinux:8	crun	1.14.3-2.module_el8.10.0+4082+f7f0c95e	ALSA-2026:35833
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+4068+0e21408f	ALSA-2026:33722
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3792+03eaed9c	ALSA-2026:33722
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+4082+f7f0c95e	ALSA-2026:33722
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+4047+545787c4	ALSA-2026:33722
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+4047+545787c4	ALSA-2026:35833
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+4068+0e21408f	ALSA-2026:35833
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+4082+f7f0c95e	ALSA-2026:35833
AlmaLinux:8	fuse-overlayfs	1.13-1.module_el8.10.0+3792+03eaed9c	ALSA-2026:35833
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4089+ce72bbbe	ALSA-2026:33722
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4090+91932338	ALSA-2026:33722
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4023+db236c53	ALSA-2026:33722
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4089+ce72bbbe	ALSA-2026:35833
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4090+91932338	ALSA-2026:35833
AlmaLinux:8	libslirp	4.4.0-2.module_el8.10.0+4023+db236c53	ALSA-2026:35833
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+4082+f7f0c95e	ALSA-2026:33722
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+4082+f7f0c95e	ALSA-2026:35833
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3970+8445edf6	ALSA-2026:33722
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+4068+0e21408f	ALSA-2026:33722
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+4102+6c76e544	ALSA-2026:33722
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+3970+8445edf6	ALSA-2026:35833
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+4068+0e21408f	ALSA-2026:35833
AlmaLinux:8	libslirp-devel	4.4.0-2.module_el8.10.0+4102+6c76e544	ALSA-2026:35833
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3970+8445edf6	ALSA-2026:35833
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+4082+f7f0c95e	ALSA-2026:35833
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+4023+db236c53	ALSA-2026:35833
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+4023+db236c53	ALSA-2026:33722
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+4082+f7f0c95e	ALSA-2026:33722
AlmaLinux:8	netavark	2:1.10.3-1.module_el8.10.0+3970+8445edf6	ALSA-2026:33722
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+4068+0e21408f	ALSA-2026:35833
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+4047+545787c4	ALSA-2026:35833
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:35833
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+4068+0e21408f	ALSA-2026:33722
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+3909+6e1c1eb7	ALSA-2026:33722
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	oci-seccomp-bpf-hook	1.2.10-1.module_el8.10.0+4047+545787c4	ALSA-2026:33722
AlmaLinux:10	opentelemetry-collector	0.144.0-2.el10_2	ALSA-2026:19135
AlmaLinux:9	opentelemetry-collector	0.144.0-2.el9_8	ALSA-2026:19353
AlmaLinux:8	osbuild-composer	101.5-1.el8_10.alma.1	ALSA-2026:48790
AlmaLinux:8	osbuild-composer-core	101.5-1.el8_10.alma.1	ALSA-2026:48790
AlmaLinux:8	osbuild-composer-worker	101.5-1.el8_10.alma.1	ALSA-2026:48790
AlmaLinux:10	podman	7:5.8.2-1.el10_2.alma.1	ALSA-2026:19017
AlmaLinux:8	podman	4:4.9.4-31.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	podman	4:4.9.4-32.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:9	podman	6:5.8.2-1.el9_8	ALSA-2026:19173
AlmaLinux:8	podman-catatonit	4:4.9.4-32.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:8	podman-catatonit	4:4.9.4-31.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:10	podman-docker	7:5.8.2-1.el10_2.alma.1	ALSA-2026:19017
AlmaLinux:8	podman-docker	4:4.9.4-32.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:8	podman-docker	4:4.9.4-31.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:9	podman-docker	6:5.8.2-1.el9_8	ALSA-2026:19173
AlmaLinux:8	podman-gvproxy	4:4.9.4-31.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	podman-gvproxy	4:4.9.4-32.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:8	podman-plugins	4:4.9.4-31.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	podman-plugins	4:4.9.4-32.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:9	podman-plugins	6:5.8.2-1.el9_8	ALSA-2026:19173
AlmaLinux:10	podman-remote	7:5.8.2-1.el10_2.alma.1	ALSA-2026:19017
AlmaLinux:8	podman-remote	4:4.9.4-31.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	podman-remote	4:4.9.4-32.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:9	podman-remote	6:5.8.2-1.el9_8	ALSA-2026:19173
AlmaLinux:10	podman-tests	7:5.8.2-1.el10_2.alma.1	ALSA-2026:19017
AlmaLinux:8	podman-tests	4:4.9.4-32.module_el8.10.0+4213+0493256b	ALSA-2026:35833
AlmaLinux:8	podman-tests	4:4.9.4-31.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:9	podman-tests	6:5.8.2-1.el9_8	ALSA-2026:19173
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2026:35833
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3970+8445edf6	ALSA-2026:33722
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2026:33722
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3876+e55593a8	ALSA-2026:33722
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3901+4b80ecd7	ALSA-2026:35833
AlmaLinux:8	python3-criu	3.18-5.module_el8.10.0+3970+8445edf6	ALSA-2026:35833
AlmaLinux:8	python3-podman	4.9.0-3.module_el8.10.0+4016+efd18bf8	ALSA-2026:33722
AlmaLinux:8	python3-podman	4.9.0-3.module_el8.10.0+4016+efd18bf8	ALSA-2026:35833
AlmaLinux:8	runc	4:1.2.9-4.module_el8.10.0+4136+16425343	ALSA-2026:33722
AlmaLinux:8	runc	4:1.2.9-4.module_el8.10.0+4136+16425343	ALSA-2026:35833
AlmaLinux:8	skopeo	2:1.14.6-2.module_el8.10.0+4211+49ea0979	ALSA-2026:35833
AlmaLinux:8	skopeo	2:1.14.6-2.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	skopeo-tests	2:1.14.6-2.module_el8.10.0+4211+49ea0979	ALSA-2026:33722
AlmaLinux:8	skopeo-tests	2:1.14.6-2.module_el8.10.0+4211+49ea0979	ALSA-2026:35833
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+4023+db236c53	ALSA-2026:33722
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+4082+f7f0c95e	ALSA-2026:33722
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+4047+545787c4	ALSA-2026:33722
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3926+f12484f5	ALSA-2026:33722
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+3926+f12484f5	ALSA-2026:35833
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+4023+db236c53	ALSA-2026:35833
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+4082+f7f0c95e	ALSA-2026:35833
AlmaLinux:8	slirp4netns	1.2.3-1.module_el8.10.0+4047+545787c4	ALSA-2026:35833
AlmaLinux:8	toolbox	0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	toolbox	0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	toolbox-tests	0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:35833
AlmaLinux:8	toolbox-tests	0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47	ALSA-2026:33722
AlmaLinux:8	udica	0.2.6-21.module_el8.10.0+4068+0e21408f	ALSA-2026:35833
AlmaLinux:8	udica	0.2.6-21.module_el8.10.0+4068+0e21408f	ALSA-2026:33722
Alpine:v3.23	skopeo	1.20.1-r0	ALPINE-CVE-2026-34986
Alpine:v3.24	skopeo	1.20.1-r0	ALPINE-CVE-2026-34986
Debian:13	golang-github-go-jose-go-jose	no fix listed	DEBIAN-CVE-2026-34986
Debian:14	golang-github-go-jose-go-jose	4.1.4-1	DEBIAN-CVE-2026-34986
Debian:13	golang-github-go-jose-go-jose.v3	no fix listed	DEBIAN-CVE-2026-34986
Debian:14	golang-github-go-jose-go-jose.v3	3.0.5-1	DEBIAN-CVE-2026-34986
Debian:12	golang-gopkg-square-go-jose.v1	no fix listed	DEBIAN-CVE-2026-34986
Debian:13	golang-gopkg-square-go-jose.v1	no fix listed	DEBIAN-CVE-2026-34986
Debian:14	golang-gopkg-square-go-jose.v1	no fix listed	DEBIAN-CVE-2026-34986
Debian:12	golang-gopkg-square-go-jose.v2	no fix listed	DEBIAN-CVE-2026-34986
Debian:13	golang-gopkg-square-go-jose.v2	no fix listed	DEBIAN-CVE-2026-34986
Debian:14	golang-gopkg-square-go-jose.v2	no fix listed	DEBIAN-CVE-2026-34986
Go	github.com/go-jose/go-jose	no fix listed	GHSA-78h2-9frx-2jm8
Go	github.com/go-jose/go-jose/v3	3.0.5	GHSA-78h2-9frx-2jm8
Go	github.com/go-jose/go-jose/v3	3.0.5	GO-2026-4945
Go	github.com/go-jose/go-jose/v4	4.1.4	GHSA-78h2-9frx-2jm8
Go	github.com/go-jose/go-jose/v4	4.1.4	GO-2026-4945
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+40047+0c0a73f4	RLSA-2026:33722
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9	RLSA-2026:35833
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9	RLSA-2026:33722
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+2001+6a33db9f	RLSA-2026:35833
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+2001+6a33db9f	RLSA-2026:33722
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1896+b18fa106	RLSA-2026:33722
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1880+8e896d1b	RLSA-2026:33722
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+40133+32c21f88	RLSA-2026:33722
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1874+ce489889	RLSA-2026:33722
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1896+b18fa106	RLSA-2026:35833
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1874+ce489889	RLSA-2026:35833
Rocky Linux:8	aardvark-dns	2:1.10.1-2.module+el8.10.0+1880+8e896d1b	RLSA-2026:35833

Affected products (as reported)

Vendor	Product	Versions
go-jose	go-jose	>= 4.0.0, < 4.1.4< 3.0.5

Weakness: CWE-248, CWE-131 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8 x_refsource_CONFIRM
https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-34986 vdb-entry, x_refsource_REDHAT
RHBZ#2455470 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34986.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:65906 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65838 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62548 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66385 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17789 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60452 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60444 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60449 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20569 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19719 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27856 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17040 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:16696 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22937 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19135 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22450 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19017 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33722 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35833 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:48790 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49944 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25252 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25248 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25250 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34192 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:32991 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34196 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34197 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19721 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20607 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:19720 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26054 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17287 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20609 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:10135 vendor-advisory, x_refsource_REDHAT