CVE-2026-116586
Go JOSE: Panics in JSON parsing
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
| CWE | CWE-674 |
| Vendor | go-jose |
| Product | go-jose |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-jose go-jose
Be the first to know when new unknown vulnerabilities affecting go-jose go-jose are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
go-jose / go-jose
< 4.1.5
References
github.com: https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4 github.com: https://github.com/go-jose/go-jose/pull/290 github.com: https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a github.com: https://github.com/go-jose/go-jose/releases/tag/v4.1.5