CVE-2026-116586
Go JOSE: Panics in JSON parsing
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Go JOSE: Panics in JSON parsing
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
CVE-2026-116586- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2026-110466
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
EUVD-2026-110466- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vvm8-gf78-28g4
Go JOSE: Panics in JSON parsing
Summary
Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.
Impact
Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.
Workarounds
Reject large inputs before parsing them.
Acknowledgements
Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.
- Record
GHSA-vvm8-gf78-28g4- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-674
- Updated
- 2026-11-02
NVD
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
CVE-2026-116586- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
Go JOSE: Panics in JSON parsing
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
CVE-2026-116586- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-674
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-116586
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
DEBIAN-CVE-2026-116586- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 25 moreShow less
OSVGHSA-vvm8-gf78-28g4
Go JOSE: Panics in JSON parsing
Summary
Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.
Impact
Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.
Workarounds
Reject large inputs before parsing them.
Acknowledgements
Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.
- Record
GHSA-vvm8-gf78-28g4- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-116586
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
UBUNTU-CVE-2026-116586- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVAZL-111682 No score
CVE-2026-116586 affecting package buildah 1.43.1-3
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111682- Updated
- 2026-11-05
OSVAZL-111685 No score
CVE-2026-116586 affecting package cri-o 1.30.1-1
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111685- Updated
- 2026-11-05
OSVAZL-111715 No score
CVE-2026-116586 affecting package podman 5.6.1-10
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111715- Updated
- 2026-11-05
OSVAZL-111808 No score
CVE-2026-116586 affecting package azcopy 10.25.1-10
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111808- Updated
- 2026-11-05
OSVAZL-111821 No score
CVE-2026-116586 affecting package cert-manager 1.12.15-15
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111821- Updated
- 2026-11-05
OSVAZL-111869 No score
CVE-2026-116586 affecting package containerd2 2.3.7-1
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111869- Updated
- 2026-11-05
OSVAZL-111875 No score
CVE-2026-116586 affecting package containerized-data-importer 1.62.0-9
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111875- Updated
- 2026-11-05
OSVAZL-111905 No score
CVE-2026-116586 affecting package dcos-cli 1.2.0-22
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111905- Updated
- 2026-11-05
OSVAZL-111923 No score
CVE-2026-116586 affecting package docker-buildx 0.14.0-19
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111923- Updated
- 2026-11-05
OSVAZL-111929 No score
CVE-2026-116586 affecting package docker-cli 25.0.7-6
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111929- Updated
- 2026-11-05
OSVAZL-111932 No score
CVE-2026-116586 affecting package docker-compose 2.27.0-16
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111932- Updated
- 2026-11-05
OSVAZL-111962 No score
CVE-2026-116586 affecting package ignition-flatcar 2.22.0-7
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111962- Updated
- 2026-11-05
OSVAZL-111971 No score
CVE-2026-116586 affecting package influxdb 2.7.5-23
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-111971- Updated
- 2026-11-05
OSVAZL-112001 No score
CVE-2026-116586 affecting package keda 2.14.1-19
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112001- Updated
- 2026-11-02
OSVAZL-112034 No score
CVE-2026-116586 affecting package kubernetes 1.30.10-32
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112034- Updated
- 2026-11-05
OSVAZL-112049 No score
CVE-2026-116586 affecting package libcontainers-common 20240213-3
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112049- Updated
- 2026-11-05
OSVAZL-112076 No score
CVE-2026-116586 affecting package moby-containerd-cc 1.7.7-19
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112076- Updated
- 2026-11-05
OSVAZL-112106 No score
CVE-2026-116586 affecting package packer 1.9.5-23
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112106- Updated
- 2026-11-05
OSVAZL-112226 No score
CVE-2026-116586 affecting package skopeo 1.14.4-15
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112226- Updated
- 2026-11-05
OSVAZL-112244 No score
CVE-2026-116586 affecting package telegraf 1.31.0-36
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112244- Updated
- 2026-11-05
OSVAZL-112265 No score
CVE-2026-116586 affecting package vitess 19.0.4-16
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
- Record
AZL-112265- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12478-1 No score
skopeo-1.24.0-2.1 on GA media
These are all security issues fixed in the skopeo-1.24.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12478-1- Updated
- 2026-11-07
OSVSUSE-SU-2026:24604-1 No score
Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issues:
- CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286994).
- CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287058).
- CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287137).
- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285292).
- CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287487).
- CVE-2026-116585,CVE-2026-116586,CVE-2026-116587: github.com/go-jose/go-jose/v4: multiple security issues in github.com/go-jose/go-jose before 4.1.6 (bsc#1288375).
- Record
SUSE-SU-2026:24604-1- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/go-jose/go-jose/v4Go |
before 4.1.5 | 4.1.5 |
github.com/go-jose/go-jose/v3Go |
through 3.0.5 | None known |
buildahAzure Linux:3 |
through 1.43.1-3 | None known |
cri-oAzure Linux:3 |
through 1.30.1-1 | None known |
podmanAzure Linux:3 |
through 5.6.1-10 | None known |
azcopyAzure Linux:3 |
through 10.25.1-10 | None known |
cert-managerAzure Linux:3 |
through 1.12.15-15 | None known |
containerd2Azure Linux:3 |
through 2.3.7-1 | None known |
containerized-data-importerAzure Linux:3 |
through 1.62.0-9 | None known |
dcos-cliAzure Linux:3 |
through 1.2.0-22 | None known |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
docker-buildxAzure Linux:3 |
through 0.14.0-19 | None known |
docker-cliAzure Linux:3 |
through 25.0.7-6 | None known |
docker-composeAzure Linux:3 |
through 2.27.0-16 | None known |
ignition-flatcarAzure Linux:3 |
through 2.22.0-7 | None known |
influxdbAzure Linux:3 |
through 2.7.5-23 | None known |
kedaAzure Linux:3 |
through 2.14.1-19 | None known |
kubernetesAzure Linux:3 |
through 1.30.10-32 | None known |
libcontainers-commonAzure Linux:3 |
through 20240213-3 | None known |
moby-containerd-ccAzure Linux:3 |
through 1.7.7-19 | None known |
packerAzure Linux:3 |
through 1.9.5-23 | None known |
skopeoAzure Linux:3 |
through 1.14.4-15 | None known |
telegrafAzure Linux:3 |
through 1.31.0-36 | None known |
vitessAzure Linux:3 |
through 19.0.4-16 | None known |
golang-github-go-jose-go-joseDebian:13 |
All versions, plus listed versions 4.0.5-14.1.3-14.1.4-14.1.4-1~bpo13+14.1.4-2 |
None known |
golang-github-go-jose-go-joseDebian:14 |
All versions, plus listed versions 4.0.5-14.1.3-14.1.4-14.1.4-1~bpo13+14.1.4-2 |
None known |
golang-github-go-jose-go-jose.v3Debian:13 |
All versions, plus listed versions 3.0.3-63.0.5-1 |
None known |
golang-github-go-jose-go-jose.v3Debian:14 |
All versions, plus listed versions 3.0.3-63.0.5-1 |
None known |
golang-gopkg-square-go-jose.v1Debian:12 |
All versions, plus listed versions 1.1.2-4 |
None known |
golang-gopkg-square-go-jose.v1Debian:13 |
All versions, plus listed versions 1.1.2-4 |
None known |
golang-gopkg-square-go-jose.v1Debian:14 |
All versions, plus listed versions 1.1.2-4 |
None known |
golang-gopkg-square-go-jose.v2Debian:12 |
All versions, plus listed versions 2.6.0-22.6.3-12.6.3-22.6.3-32.6.3-42.6.3-4~exp0 |
None known |
golang-gopkg-square-go-jose.v2Debian:13 |
All versions, plus listed versions 2.6.3-32.6.3-42.6.3-4~exp0 |
None known |
golang-gopkg-square-go-jose.v2Debian:14 |
All versions, plus listed versions 2.6.3-32.6.3-42.6.3-4~exp0 |
None known |
google-cloud-sap-agentSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs |
before 3.15-160000.5.1 | 3.15-160000.5.1 |
google-cloud-sap-agentSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs |
before 3.15-160000.5.1 | 3.15-160000.5.1 |
golang-gopkg-square-go-jose.v2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.3.1-1 |
None known |
golang-gopkg-square-go-jose.v2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.5.1-22.6.0-1 |
None known |
golang-github-go-jose-go-joseUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.1-13.0.1-24.0.1-44.0.1-4ubuntu0.14.0.1-4ubuntu0.24.0.1-4ubuntu0.3 |
None known |
golang-gopkg-square-go-jose.v2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.6.0-2 |
None known |
golang-github-go-jose-go-joseUbuntu:26.10 |
All versions, plus listed versions 4.0.5-1build14.1.4-14.1.4-2 |
None known |
golang-github-go-jose-go-jose.v3Ubuntu:26.10 |
All versions, plus listed versions 3.0.3-6 |
None known |
golang-gopkg-square-go-jose.v2Ubuntu:26.10 |
All versions, plus listed versions 2.6.3-32.6.3-4 |
None known |
golang-github-go-jose-go-jose.v3Ubuntu:26.04:LTS |
All versions, plus listed versions 3.0.3-6 |
None known |
golang-gopkg-square-go-jose.v2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.6.3-3 |
None known |
golang-github-go-jose-go-joseUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 4.0.5-14.0.5-1build14.0.5-1ubuntu0.26.04.1~esm1 |
None known |
skopeoopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 1.24.0-2.1 | 1.24.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-116586 is a medium vulnerability (CVSS 6.9) in Go-jose, published October 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in github.com/go-jose/go-jose/v4 4.1.5.
References
github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4
nvd.nist.gov/vuln/detail/CVE-2026-116586
Show 21 moreShow less
security-tracker.debian.org/tracker/CVE-2026-116586
suse.com/support/update/announcement/2026/suse-su-202624604-1
bugzilla.suse.com/1285292
ubuntu.com/security/CVE-2026-116586
cve.org/CVERecord?id=CVE-2026-116586