GHSA-vvm8-gf78-28g4
Go JOSE: Panics in JSON parsing
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/go-jose/go-jose/v4 | < 4.1.5 | 4.1.5 |
| Go | github.com/go-jose/go-jose/v3 | <= 3.0.5 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.
### Impact
Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.
### Workarounds
Reject large inputs before parsing them.
### Acknowledgements
Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4
- https://nvd.nist.gov/vuln/detail/CVE-2026-116586
- https://github.com/go-jose/go-jose/pull/290
- https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a
- https://github.com/go-jose/go-jose
- https://github.com/go-jose/go-jose/releases/tag/v4.1.5