---
id: "CVE-2026-116587"
kind: "vulnerability"
aliases: ["CVE-2026-116587"]
title: "go-jose: crafted RSA key in JWK causes CPU exhaustion and denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "go-jose", "jwk", "jwt", "package"]
not_affected_if: ["go-below-1.24", "no-untrusted-jwk-parsing", "trusted-keys-only"]
published_at: "2026-10-26T22:16:55+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:27:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116587", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# go-jose: crafted RSA key in JWK causes CPU exhaustion and denial of service

go-jose parses RSA modulus and prime values from JWKs without size checks, so a crafted key makes Go's RSA validation take cubic CPU time. An attacker who can submit JWKs to an application that parses untrusted keys can cause a remote denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the go-jose version in `go.mod` (for example `grep go-jose go.mod`); versions below `4.1.6` are affected.
- Confirm the Go toolchain is `1.24` or later with `go version`, since the slowdown depends on that release.
- Find code that calls the JWK parsing functions on keys received from users or external sources.

## Fix

- Upgrade go-jose to `4.1.6` or later (`go get github.com/go-jose/go-jose/v4@v4.1.6`).
- Until upgraded, only parse JWKs from trusted sources.

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116587

## From the sources

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_