GHSA-4w3g-jfj2-cw2q

Go JOSE: Panic during CBC-HMAC processing

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-116585

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/go-jose/go-jose/v4	< 4.1.5	4.1.5
Go	github.com/go-jose/go-jose/v3	<= 3.0.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. ### Details Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292. ### Workarounds If the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact. ### Impact Denial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected. ### Acknowledgements Thanks to Joshua Rogers of AISLE Research for reporting this problem.

References

External links from the advisory. They lead to third-party sites.