GHSA-vvm8-gf78-28g4 CVE-2026-116586

Go JOSE: Panics in JSON parsing

Medium Go

Severity: 6.9 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 0.29%; Chance of exploitation in the next 30 days. Higher than 21.77% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-674 Uncontrolled Recursion
Fix: 4.1.5; Upgrade github.com/go-jose/go-jose/v4 to this version or later

Description

Summary

Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.

Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.

Impact

Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.

Workarounds

Reject large inputs before parsing them.

Acknowledgements

Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/go-jose/go-jose/v3	`<= 3.0.5`	No fix yet
github.com/go-jose/go-jose/v3	`<= 3.0.5`	No fix yet
github.com/go-jose/go-jose/v4	`< 4.1.5`	`4.1.5`
github.com/go-jose/go-jose/v4	`< 4.1.5`	`4.1.5`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/go-jose/go-jose/v4 Go → `4.1.5`

go

go get github.com/go-jose/go-jose/v4@v4.1.5 && go mod tidy

Severity breakdown

CVSS 4.0 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-674: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

How to prevent it

Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Implementation: Increase the stack size.

References

Advisories

Fixes and patches

Packages

github.com/go-jose/go-jose

Timeline

Oct 26, 2026 Published
Oct 30, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-mgcc-cww5-fp2q Go JOSE: DoS when parsing JWKs that contain RSA keys	High	Also affects github.com/go-jose/go-jose/v3
GHSA-4w3g-jfj2-cw2q Go JOSE: Panic during CBC-HMAC processing	Medium	Also affects github.com/go-jose/go-jose/v3
GHSA-78h2-9frx-2jm8 Go JOSE Panics in JWE decryption	High	Also affects github.com/go-jose/go-jose/v3
GHSA-c6gw-w398-hv78 DoS in go-jose Parsing	Medium	Also affects github.com/go-jose/go-jose/v3
GHSA-c5q2-7r4c-mv6g Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)	Medium	Also affects github.com/go-jose/go-jose/v3
GHSA-hqq3-7jhf-c5jx Forge: Denial of service in TLS record processing via call stack exhaustion	High	Same weakness, CWE-674
GHSA-wwpr-jff3-395c Crass: A large number of adjacent CSS comments can trigger a SystemStackError	Medium	Same weakness, CWE-674
GHSA-6jxj-px6v-747w Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage	Medium	Same weakness, CWE-674

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor