CVE-2026-116586— Go JOSE: Panics in JSON parsing
Quick assessment
Affected
go-jose go-jose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Go JOSE 是 Go 语言中对 JavaScript 对象签名和加密（JOSE）标准集的实现，支持 JSON Web Encryption（JWE）、JSON Web Signature（JWS）和 JSON Web Token（JWT）等标准。在 4.1.5 版本之前，通过 go-jose 解析攻击者控制的 JSON 时，若其中包含深度嵌套的数组或对象，可能导致超出 Go 的栈限制，从而引发栈溢出。该问题会导致应用程序崩溃，并使依赖 go-jose 解析不可信 JSON 的应用面临拒绝服务（DoS）风险。此问
Possible ATT&CK Techniques 1 AI
T1499.002 · Service Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-116586
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Go JOSE: Panics in JSON parsing
Source: CVE Program / CVE List V5
Vulnerability Description
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-116586
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-116586
请登录查看更多情报信息。
Other References for CVE-2026-116586 (4)
-
Release v4.1.5 · go-jose/go-jose · GitHub x_refsource_MISC
-
Crash when JSON parsing · Advisory · go-jose/go-jose · GitHub x_refsource_CONFIRM
-
json: limit stack depth (#290) · go-jose/go-jose@a31af25 · GitHub x_refsource_MISC
Same Patch Batch · go-jose · 2026-10-26 · 3 CVEs total
| CVE-2026-116587 | 7.5 HIGH | Go JOSE: DoS when parsing JWKs that contain RSA keys |
| CVE-2026-116585 | 6.9 MEDIUM | Go JOSE: Panic during CBC-HMAC processing |
IV. Related Vulnerabilities
Same product: go-jose
-
CVE-2026-116587
Go JOSE: DoS when parsing JWKs that contain RSA keys -
CVE-2026-116585
Go JOSE: Panic during CBC-HMAC processing -
CVE-2026-34986
Go JOSE affect by a panic in JWE decryption -
CVE-2025-27144
Go JOSE's Parsing Vulnerable to Denial of Service -
CVE-2024-28180
Go JOSE vulnerable to Improper Handling of Highly Compressed
Same vendor: go-jose
-
CVE-2026-116587
Go JOSE: DoS when parsing JWKs that contain RSA keys -
CVE-2026-116585
Go JOSE: Panic during CBC-HMAC processing -
CVE-2026-34986
Go JOSE affect by a panic in JWE decryption -
CVE-2025-27144
Go JOSE's Parsing Vulnerable to Denial of Service -
CVE-2024-28180
Go JOSE vulnerable to Improper Handling of Highly Compressed
Same weakness: CWE-674
-
CVE-2026-65628
Infinite recursion (CPU denial-of-service) in JOSE.JWK.share -
CVE-2026-116144
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack O -
CVE-2026-116011
Crow before 1.3.4 Denial of Service via Deeply Nested JSON i -
CVE-2026-114605
dnspython dns.name.from_wire_parser() excessive CPU use -
CVE-2026-66282
Authenticated Denial-of-Service in Zigbee Publish Billing Pe