{"id":"CVE-2026-116586","aliases":["AZL-111682","AZL-111685","AZL-111715","AZL-111808","AZL-111821","AZL-111869","AZL-111875","AZL-111905","AZL-111923","AZL-111929","AZL-111932","AZL-111962","AZL-111971","AZL-112001","AZL-112034","AZL-112049","AZL-112076","AZL-112106","AZL-112226","AZL-112244","AZL-112265","DEBIAN-CVE-2026-116586","EUVD-2026-110466","GHSA-vvm8-gf78-28g4","SUSE-SU-2026:24604-1","SUSE-SU-2026:5193-1","UBUNTU-CVE-2026-116586","openSUSE-SU-2026:12478-1","openSUSE-SU-2026:22236-1"],"status":"published","title":"Go JOSE: Panics in JSON parsing","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00292,"percentile":0.22019,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-10-26T21:09:26Z","modified":"2026-11-12T12:27:18Z","fixes":[{"ecosystem":"Go","package":"github.com/go-jose/go-jose/v4","fixed_in":["4.1.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/go-jose/go-jose/v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-jose/go-jose/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"azcopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.25.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.12.15-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.62.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"dcos-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0-22"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.0-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.7-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.27.0-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ignition-flatcar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.22.0-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.5-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.10-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.7-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.5-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.4-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.31.0-36"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"19.0.4-16"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1","4.1.3-1","4.1.4-1","4.1.4-1~bpo13+1","4.1.4-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1","4.1.3-1","4.1.4-1","4.1.4-1~bpo13+1","4.1.4-2"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-jose-go-jose.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-6","3.0.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-jose-go-jose.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-6","3.0.5-1"]},{"source":"osv","ecosystem":"Debian:12","package":"golang-gopkg-square-go-jose.v1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-4"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-gopkg-square-go-jose.v1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-4"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-gopkg-square-go-jose.v1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-4"]},{"source":"osv","ecosystem":"Debian:12","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-2","2.6.3-1","2.6.3-2","2.6.3-3","2.6.3-4","2.6.3-4~exp0"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3-3","2.6.3-4","2.6.3-4~exp0"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3-3","2.6.3-4","2.6.3-4~exp0"]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-jose/go-jose/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.0.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-150300.11.25.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.1-2","2.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-1","3.0.1-2","4.0.1-4","4.0.1-4ubuntu0.1","4.0.1-4ubuntu0.2","4.0.1-4ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1build1","4.1.4-1","4.1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-go-jose-go-jose.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3-3","2.6.3-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-go-jose-go-jose.v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-gopkg-square-go-jose.v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"golang-github-go-jose-go-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-1","4.0.5-1build1","4.0.5-1ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"google-cloud-sap-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-160000.5.1"}]}],"bundled":8}],"products":[{"vendor":"go-jose","product":"go-jose"}],"references":[{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/go-jose/go-jose/pull/290","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/go-jose/go-jose/releases/tag/v4.1.5","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vvm8-gf78-28g4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116586.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116586","tags":["advisory"]},{"url":"https://github.com/go-jose/go-jose","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624604-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1285292","tags":["report"]},{"url":"https://bugzilla.suse.com/1286994","tags":["report"]},{"url":"https://bugzilla.suse.com/1287058","tags":["report"]},{"url":"https://bugzilla.suse.com/1287137","tags":["report"]},{"url":"https://bugzilla.suse.com/1287487","tags":["report"]},{"url":"https://bugzilla.suse.com/1288375","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97032","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265193-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262823","tags":["report"]},{"url":"https://bugzilla.suse.com/1280698","tags":["report"]},{"url":"https://bugzilla.suse.com/1288278","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79699","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-116586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116586","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-116586","title":"Go JOSE: Panics in JSON parsing","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T21:09:26.349Z","modified":"2026-10-30T18:46:23.244Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-110466","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T21:09:26Z","modified":"2026-10-30T18:46:23Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:02.630385Z"}],"ghsa":[{"id":"GHSA-vvm8-gf78-28g4","title":"Go JOSE: Panics in JSON parsing","description":"### Summary\n\nParsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.\n\nNote: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.\n\n### Impact\n\nDenial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.\n\n### Workarounds\n\nReject large inputs before parsing them.\n\n### Acknowledgements\n\nThanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.","status":"published","published":"2026-10-28T21:14:08Z","modified":"2026-10-28T21:14:09Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:41:39.926569Z"}],"nvd":[{"id":"CVE-2026-116586","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55.053Z","modified":"2026-10-30T19:18:14.34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:13:03.746397Z"}],"osv":[{"id":"CVE-2026-116586","title":"Go JOSE: Panics in JSON parsing","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T21:09:26.349Z","modified":"2026-11-12T12:27:18.681268205Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-07T17:50:16.374761Z"},{"id":"DEBIAN-CVE-2026-116586","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55.053Z","modified":"2026-10-31T09:47:30.215657788Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-vvm8-gf78-28g4","title":"Go JOSE: Panics in JSON parsing","description":"### Summary\n\nParsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.\n\nNote: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.\n\n### Impact\n\nDenial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.\n\n### Workarounds\n\nReject large inputs before parsing them.\n\n### Acknowledgements\n\nThanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.","status":"published","published":"2026-10-28T21:14:08Z","modified":"2026-10-28T21:30:05.801821772Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"UBUNTU-CVE-2026-116586","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:00Z","modified":"2026-10-28T20:16:05.019955353Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"AZL-111682","title":"CVE-2026-116586 affecting package buildah 1.43.1-3","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111685","title":"CVE-2026-116586 affecting package cri-o 1.30.1-1","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111715","title":"CVE-2026-116586 affecting package podman 5.6.1-10","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111808","title":"CVE-2026-116586 affecting package azcopy 10.25.1-10","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111821","title":"CVE-2026-116586 affecting package cert-manager 1.12.15-15","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111869","title":"CVE-2026-116586 affecting package containerd2 2.3.7-1","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111875","title":"CVE-2026-116586 affecting package containerized-data-importer 1.62.0-9","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111905","title":"CVE-2026-116586 affecting package dcos-cli 1.2.0-22","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111923","title":"CVE-2026-116586 affecting package docker-buildx 0.14.0-19","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111929","title":"CVE-2026-116586 affecting package docker-cli 25.0.7-6","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111932","title":"CVE-2026-116586 affecting package docker-compose 2.27.0-16","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111962","title":"CVE-2026-116586 affecting package ignition-flatcar 2.22.0-7","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T14:17:00.670496214Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111971","title":"CVE-2026-116586 affecting package influxdb 2.7.5-23","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T14:17:00.60789871Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-112001","title":"CVE-2026-116586 affecting package keda 2.14.1-19","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-10-31T14:17:30.805331945Z","updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-112034","title":"CVE-2026-116586 affecting package kubernetes 1.30.10-32","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112049","title":"CVE-2026-116586 affecting package libcontainers-common 20240213-3","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112076","title":"CVE-2026-116586 affecting package moby-containerd-cc 1.7.7-19","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112106","title":"CVE-2026-116586 affecting package packer 1.9.5-23","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112226","title":"CVE-2026-116586 affecting package skopeo 1.14.4-15","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112244","title":"CVE-2026-116586 affecting package telegraf 1.31.0-36","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T14:17:11.588201318Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"AZL-112265","title":"CVE-2026-116586 affecting package vitess 19.0.4-16","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","status":"published","published":"2026-10-26T22:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"openSUSE-SU-2026:12478-1","title":"skopeo-1.24.0-2.1 on GA media","description":"These are all security issues fixed in the skopeo-1.24.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:17.482856144Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:22236-1","title":"Security update for google-cloud-sap-agent","description":"This update for google-cloud-sap-agent fixes the following issues:\n\n- CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286994).\n- CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287058).\n- CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287137).\n- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285292).\n- CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287487).\n- CVE-2026-116585,CVE-2026-116586,CVE-2026-116587: github.com/go-jose/go-jose/v4: multiple security issues in\n  github.com/go-jose/go-jose before 4.1.6 (bsc#1288375).\n","status":"published","published":"2026-11-03T10:42:45Z","modified":"2026-11-11T17:23:10.717313764Z","updated_at":"2026-11-11T17:47:15.466074Z"},{"id":"SUSE-SU-2026:24604-1","title":"Security update for google-cloud-sap-agent","description":"This update for google-cloud-sap-agent fixes the following issues:\n\n- CVE-2026-78659: golang.org/x/net/http2: HTTP/2 server memory exhaustion due to Trailer headers (bsc#1286994).\n- CVE-2026-78660: golang.org/x/net/http2: HTTP/2 transport accepts malformed framing-related headers (bsc#1287058).\n- CVE-2026-78663: golang.org/x/net/http2: double flow control refund on HTTP/2 server streams (bsc#1287137).\n- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285292).\n- CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287487).\n- CVE-2026-116585,CVE-2026-116586,CVE-2026-116587: github.com/go-jose/go-jose/v4: multiple security issues in\n  github.com/go-jose/go-jose before 4.1.6 (bsc#1288375).\n","status":"published","published":"2026-11-03T10:33:35Z","modified":"2026-11-07T17:23:14.230693019Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"SUSE-SU-2026:5193-1","title":"Security update for skopeo","description":"This update for skopeo fixes the following issues:\n\n- CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a missing\n  encrypted key can lead to a denial of service (bsc#1262823).\n- CVE-2026-79699: crafted tar archive containing malicious whiteout header can cause the extraction destination\n  directory to be replaced with an arbitrary file (bsc#1280698).\n- CVE-2026-116585,CVE-2026-116586,CVE-2026-116587: github.com/go-jose/go-jose/v4: multiple security issues in\n  github.com/go-jose/go-jose before 4.1.6 (bsc#1288278).\n","status":"published","published":"2026-11-11T12:31:20Z","modified":"2026-11-12T12:15:05.362036482Z","updated_at":"2026-11-12T12:48:34.460153Z"}]}}