Skip to content
OpenAdvisories

Package · Go

github.com/square/go-jose

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.6
    CVE-2025-27144

    Go JOSE's Parsing Vulnerable to Denial of Service

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to ve…

    go-jose go-jose github.com/go-jose/go-jose/v3 golang-github-go-jose-go-jose Debian Ubuntu Go
  • Medium —
    GHSA-2c7c-3mj9-8fqh

    Decryption of malicious PBES2 JWE objects can consume unbounded system resources

    The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-servic…

    github.com/go-jose/go-jose/v3 github.com/square/go-jose Go