GO-2026-4945
Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
At a glance
- Published
- Updated
- CVE
- CVE-2026-34986
- Aliases
- GHSA-78h2-9frx-2jm8
Description
The go-jose package is subject to a panic when decrypting certain JSON Web Encryption (JWE) tokens. This occurs when an attacker can provide a maliciously crafted JWE token that triggers an unhandled exception during the decryption process, leading to a denial-of-service.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/go-jose/go-jose/v3 | introduced 0, fixed 3.0.5 |
| Go · github.com/go-jose/go-jose/v4 | introduced 0, fixed 4.1.4 |
References
- https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8 ADVISORY
- https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |