Medium severity · published Oct 26, 2026
CVE-2026-116586
Go JOSE: Panics in JSON parsing
New
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
go-jose · go-jose
< 4.1.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116586
github.com
https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a
github.com
https://github.com/go-jose/go-jose/pull/290
github.com
https://github.com/go-jose/go-jose/releases/tag/v4.1.5
github.com
https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4
More from go-jose
7.5
CVE-2026-116587
Go JOSE: DoS when parsing JWKs that contain RSA keys
7.5
CVE-2026-34986
Go JOSE affect by a panic in JWE decryption
6.9
CVE-2026-116585
Go JOSE: Panic during CBC-HMAC processing