[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-jose/go-jose/v4	v4.1.0 → v4.1.6

---

Go JOSE Panics in JWE decryption

CVE-2026-34986 / GHSA-78h2-9frx-2jm8

More information

Details

Impact

Decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key.

This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected.

This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common.

Panics can lead to denial of service.

Fixed In

4.1.4 and v3.0.5

Workarounds

If the list of keyAlgorithms passed to ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() does not include key wrapping algorithms (those ending in KW), your application is unaffected.

If your application uses key wrapping, you can prevalidate to the JWE objects to ensure the encrypted_key field is nonempty. If your application accepts JWE Compact Serialization, apply that validation to the corresponding field of that serialization (the data between the first and second .).

Thanks

Thanks to Datadog's Security team for finding this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8
• https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants
• https://nvd.nist.gov/vuln/detail/CVE-2026-34986
• https://github.com/advisories/GHSA-78h2-9frx-2jm8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Go JOSE: DoS when parsing JWKs that contain RSA keys

CVE-2026-116587 / GHSA-mgcc-cww5-fp2q

More information

Details

Summary

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.

Details

go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.

https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700

Proof of concept

No special configuration of go-jose is required to reproduce this vulnerability.

package main

import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"math/big"
	"time"

	"github.com/go-jose/go-jose/v4"
)

func main() {
	// The RSA parameters can be complete junk. The CPU cost is in validating them.
	primeBits := 16384
	p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1))
	p.SetBit(p, 0, 1)
	n := new(big.Int).Lsh(big.NewInt(1), 2048)
	e := big.NewInt(65537)
	d := big.NewInt(3)
	q := big.NewInt(3)

	jwk := map[string]string{
		"kty": "RSA",
		"n":   base64.RawURLEncoding.EncodeToString(n.Bytes()),
		"e":   base64.RawURLEncoding.EncodeToString(e.Bytes()),
		"d":   base64.RawURLEncoding.EncodeToString(d.Bytes()),
		"p":   base64.RawURLEncoding.EncodeToString(p.Bytes()),
		"q":   base64.RawURLEncoding.EncodeToString(q.Bytes()),
	}

	protected := map[string]any{
		"alg": "RS256",
		"jwk": jwk,
	}
	protJSON, _ := json.Marshal(protected)

	jws := map[string]string{
		"protected": base64.RawURLEncoding.EncodeToString(protJSON),
		"payload":   base64.RawURLEncoding.EncodeToString([]byte(`{}`)),
		"signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")),
	}
	jwsJSON, _ := json.Marshal(jws)

	start := time.Now()
	_, err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256})
	elapsed := time.Since(start)

	fmt.Printf("prime bits: %d\n", primeBits)
	fmt.Printf("parse time: %s\n", elapsed)
	fmt.Printf("parse error: %v\n", err)
}

Impact

Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately.

Credits

Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier)

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q
• https://nvd.nist.gov/vuln/detail/CVE-2026-116587
• https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230
• https://github.com/go-jose/go-jose/releases/tag/v4.1.6
• https://github.com/advisories/GHSA-mgcc-cww5-fp2q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Go JOSE: Panic during CBC-HMAC processing

CVE-2026-116585 / GHSA-4w3g-jfj2-cw2q

More information

Details

Summary

Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input.

Note this advisory is the same as GHSA-6mp9-8xrw-74r4.

Details

Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292.

Workarounds

If the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact.

Impact

Denial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected.

Acknowledgements

Thanks to Joshua Rogers of AISLE Research for reporting this problem.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q
• https://nvd.nist.gov/vuln/detail/CVE-2026-116585
• https://github.com/go-jose/go-jose/pull/292
• https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6
• https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54
• https://github.com/go-jose/go-jose/releases/tag/v4.1.5
• https://github.com/advisories/GHSA-4w3g-jfj2-cw2q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Go JOSE: Panics in JSON parsing

CVE-2026-116586 / GHSA-vvm8-gf78-28g4

More information

Details

Summary

Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.

Note: this advisory is the same as GHSA-6mp9-8xrw-74r4.

Impact

Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.

Workarounds

Reject large inputs before parsing them.

Acknowledgements

Thanks to Dohyun Kim (@​azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4
• https://nvd.nist.gov/vuln/detail/CVE-2026-116586
• https://github.com/go-jose/go-jose/pull/290
• https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a
• https://github.com/go-jose/go-jose/releases/tag/v4.1.5
• https://github.com/advisories/GHSA-vvm8-gf78-28g4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.1.6

Compare Source

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

• Reject mismatched JWE CEK lengths by @​akshithg in #​266
• Add a tests containerfile and threat model by @​mcpherrinm in #​300
• Fix error message for future issued tokens by @​inahga in #​303

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

v4.1.5

Compare Source

Fixed security issues

• cipher/cbc_hmac: don't panic on empty ciphertext (#​292)
• cipher/cbc_hmac: don't panic on invalid key (#​291)
• json: limit stack depth (#​290)
• jwt: reject out-of-range NumericDate values (#​278)
• Check alg against pubkey curve during verify. (#​293)
• Reject malformed Ed25519 JWKs (#​250)
• jws: choose verification key per-signature (#​243)

Breaking Changes

In #​226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

• Verify OpaqueSigner's Public() return is public (#​260)
• jws: skip signature on ErrJWKSKidNotFound (#​248)
• Handle JWE JSON without protected header (#​240)
• jws: don't strip internal whitespace before parsing JSON (#​239)
• jws: fewer calls to OpaqueSigner.Public() (#​224)
• Return a specific error when parsing empty string (#​216)
• Reject typed nil at Verify time (#​285)

v4.1.4

Compare Source

What's Changed

Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8

Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4

v4.1.3

Compare Source

This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop x/crypto and no longer have any external dependencies in go-jose outside of the standard library!

This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.

What's Changed

• Remove Go 1.23 support by @​mcpherrinm in #​205
• Reject JWS with an unprotected critical b64 header by @​mcpherrinm in #​210

Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3

v4.1.2

Compare Source

What's Changed

go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.

• Update go-jose documentation by @​mcpherrinm in #​198
• Remove dependency on testify by @​wardviaene in #​197
• Improve error message for invalid private keys by @​ProjectMutilation in #​195
• JWK unsupported error when unmarshalling by @​fprojetto in #​191
• Add JSONWebKey type to makeJWERecipient by @​alvarolivie in #​200
• testutils/assert: remove True, Nil, NotNil by @​jsha in #​202

New Contributors

• @​wardviaene made their first contribution in #​197
• @​fprojetto made their first contribution in #​191
• @​alvarolivie made their first contribution in #​200

Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2

v4.1.1

Compare Source

What's Changed

• Drop go-cmp dependency by @​mcpherrinm in #​186
• jws: improve performance and allocations for ParseSignedCompact by @​drakkan in #​188
• Add missing quote to unknown curve message #​170 by @​sudhanvaghebbale in #​189
• Fix incorrect validation by @​ProjectMutilation in #​192
• Restore Go 1.23 compatibility by @​anuraaga in #​193

New Contributors

• @​drakkan made their first contribution in #​188
• @​sudhanvaghebbale made their first contribution in #​189
• @​ProjectMutilation made their first contribution in #​192
• @​anuraaga made their first contribution in #​193

Full Changelog: go-jose/go-jose@v4.1.0...v4.1.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24 -> 1.24.0