Live › vulnerability › CVE-2026-116586
Go to dashboardgo-jose, a Go library for JWE, JWS and JWT, overflows the stack when parsing attacker-controlled JSON with deeply nested arrays or objects. The resulting crash lets an attacker cause denial of service in applications that parse untrusted JSON through it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications that use go-jose before 4.1.5 to parse JSON an outside party controls, such as JWTs or JWE/JWS payloads received from clients. Services that only sign or parse tokens they generate themselves are less exposed, and the sources do not say whether an unauthenticated request reaches the parser.
No product ranges from the sources yet.
go list -m github.com/go-jose/go-jose/v4 in the project to see the go-jose version in usego list -m all | grep go-jose to find indirect copies pulled in by other dependencies4.1.5 or later with go get github.com/go-jose/go-jose/[email protected] then go mod tidyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-116586")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.