GitHub Advisoryadvisory · Go

GHSA-vvm8-gf78-28g4 Go JOSE: Panics in JSON parsing

MEDIUM Published 2026-10-28 Modified 2026-10-28 Official page ↗
Aliases
CVE-2026-116586
Ecosystem
Go
Packages
github.com/go-jose/go-jose/v4, github.com/go-jose/go-jose/v3
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-674
Reviewed
2026-10-28

Affected packages

• Go github.com/go-jose/go-jose/v4: < 4.1.5 → fixed in 4.1.5 • Go github.com/go-jose/go-jose/v3: <= 3.0.5 (no fix yet)

Description

Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed. Workarounds Reject large inputs before parsing them. Acknowledgements Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.

Related

Alias · CVE (1)

  • CVE-2026-116586 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web… vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References