Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-116586 EUVD-2026-110466GHSA-vvm8-gf78-28g4

Go JOSE: Panics in JSON parsing

Published Oct 26, 2026 · Updated Oct 30, 2026 · Assigned by GitHub_M

Vendor: go-jose Product: go-jose Package: apko Package: argo-workflow-controller-4.0 Package: argo-workflow-executor-3.7 Package: argo-workflow-executor-4.0 Package: argo-workflows-3.7 Package: argo-workflows-4.0 Package: azcopy Package: bank-vaults Package: bank-vaults-template Package: buildah Package: caddy Package: cert-manager Package: containerd-1 Package: containerd2 Package: containerized-data-importer Package: cri-o Package: crossplane-2.2 Package: crossplane-2.2-crank Package: dagdotdev Package: datadog-agent-7.78 Package: datadog-agent-7.79 Package: datadog-agent-7.80 Package: datadog-agent-7.81 Package: datadog-cluster-agent-7.78 Package: datadog-cluster-agent-7.79 Package: datadog-cluster-agent-7.80 Package: datadog-cluster-agent-7.81 Package: dcos-cli Package: docker-buildx Package: docker-cli Package: docker-compose Package: external-secrets-operator-2.5 Package: flyte Package: gcsfuse Package: github.com/go-jose/go-jose/v3 Package: github.com/go-jose/go-jose/v4 Package: gitlab-kas-19.2 Package: gitlab-kas-19.5 Package: golang-github-go-jose-go-jose Package: golang-github-go-jose-go-jose Package: golang-github-go-jose-go-jose.v3 Package: golang-github-go-jose-go-jose.v3 Package: golang-gopkg-square-go-jose.v1 Package: golang-gopkg-square-go-jose.v2 Package: golang-gopkg-square-go-jose.v2 Package: grafana-pyroscope-1.19 Package: hydra Package: ignition-flatcar Package: influxdb Package: k3d-proxy Package: k3s-1.32 Package: k3s-static-1.32 Package: keda Package: knative-eventing-1.21-channel-controller Package: knative-eventing-1.21-channel-dispatcher Package: knative-eventing-1.21-controller Package: knative-eventing-1.21-filter Package: knative-eventing-1.21-ingress Package: knative-eventing-1.21-jobsink Package: knative-eventing-1.21-mtchannel-broker Package: knative-eventing-1.21-webhook Package: knative-eventing-1.22-channel-controller Package: knative-eventing-1.22-channel-dispatcher Package: knative-eventing-1.22-controller Package: knative-eventing-1.22-filter Package: knative-eventing-1.22-ingress Package: knative-eventing-1.22-jobsink Package: knative-eventing-1.22-mtchannel-broker Package: knative-eventing-1.22-webhook Package: ko Package: kserve-agent Package: kserve-localmodel Package: kserve-manager Package: kserve-router Package: kubernetes Package: kubescape-operator Package: libcontainers-common Package: melange Package: migrate Package: moby-containerd-cc Package: neuvector-scanner Package: no-docs-check Package: oauth2-proxy Package: openbao Package: opentelemetry-collector-contrib Package: opentofu-1.9 Package: packer Package: podman Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: ratify Package: skopeo Package: snyk-cli Package: spire-server Package: step Package: step-ca Package: step-issuer Package: step-kms-plugin Package: symlink-check Package: tekton-pipelines-controller-1.11 Package: tekton-pipelines-entrypoint-1.11 Package: tekton-pipelines-sidecarlogresults-1.11 Package: telegraf Package: tw Package: twt Package: vault-benchmark Package: vault-env Package: velero Package: vitess Package: vitess-24 Package: vitess-24-binaries Package: wal-g-pg Package: wolfictl Package: zarf Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.

Affected products

VendorProductAffectedFixed
go-jose go-jose < 4.1.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-github-go-jose-go-jose +3 No fix yet —
Debian 13 golang-github-go-jose-go-jose +3 No fix yet —
Debian 12 golang-gopkg-square-go-jose.v1 +1 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-go-jose-go-jose +2 No fix yet —
Ubuntu 26.04 LTS golang-gopkg-square-go-jose.v2 +1 No fix yet —
Ubuntu 24.04 LTS golang-github-go-jose-go-jose +1 No fix yet —
Ubuntu 22.04 LTS golang-gopkg-square-go-jose.v2 No fix yet —
Ubuntu 20.04 LTS golang-gopkg-square-go-jose.v2 No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS golang-github-go-jose-go-jose No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLES 15 SP6 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLES 15 SP5 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLES 15 SP4 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 google-cloud-sap-agent 3.15-160000.5.1 SUSE-SU-2026:24604-1
SLES for SAP 15 SP6 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLES for SAP 15 SP5 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLES for SAP 15 SP4 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLES 16.0 google-cloud-sap-agent 3.15-160000.5.1 SUSE-SU-2026:24604-1
SLE Micro 5.5 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLE HPC 15 SP5 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1
SLE HPC 15 SP4 skopeo 1.14.4-150300.11.25.1 SUSE-SU-2026:5193-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed skopeo 1.24.0-2.1 openSUSE-SU-2026:12478-1
openSUSE Leap 16.0 google-cloud-sap-agent 3.15-160000.5.1 openSUSE-SU-2026:22236-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 buildah 2:1.43.1-1.amzn2023.0.4 ALAS2023-2026-3451
Amazon Linux 2023 skopeo +1 2:1.22.2-1.amzn2023.0.4 ALAS2023-2026-3450

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 keda +20 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apko 1.4.14-r0 —
Wolfi rolling argo-workflows-4.0 +2 4.0.15-r3 —
Wolfi rolling bank-vaults +1 1.33.2-r10 —
Wolfi rolling caddy +38 No fix yet —
Wolfi rolling crossplane-2.2 +1 2.2.7-r3 —
Wolfi rolling dagdotdev 0.0.20-r35 —
Wolfi rolling datadog-agent-7.78 +1 7.78.4-r30 —
Wolfi rolling datadog-agent-7.79 +1 7.79.2-r32 —
Wolfi rolling datadog-agent-7.80 +1 7.80.4-r28 —
Wolfi rolling external-secrets-operator-2.5 2.5.0-r23 —
Wolfi rolling flyte 1.16.9-r4 —
Wolfi rolling gcsfuse 2.12.2-r41 —
Wolfi rolling gitlab-kas-19.5 19.5.3-r1 —
Wolfi rolling ko 0.19.1-r13 —
Wolfi rolling kserve-agent +3 0.21.0-r15 —
Wolfi rolling kubescape-operator 0.2.204-r1 —
Wolfi rolling melange 0.64.1-r0 —
Wolfi rolling migrate 4.20.1-r8 —
Wolfi rolling neuvector-scanner 4.313-r0 —
Wolfi rolling oauth2-proxy 7.15.6-r0 —
Wolfi rolling opentelemetry-collector-contrib 0.161.0-r0 —
Wolfi rolling rancher-2.13 2.13.11-r0 —
Wolfi rolling rancher-2.14 2.14.7-r0 —
Wolfi rolling snyk-cli 1.1308.3-r1 —
Wolfi rolling step 0.31.0-r10 —
Wolfi rolling step-ca 0.30.2-r32 —
Wolfi rolling step-issuer 0.12.0-r21 —
Wolfi rolling tw +3 0.0.56-r0 —
Wolfi rolling vault-env 1.23.0-r17 —
Wolfi rolling velero 1.18.4-r6 —
Wolfi rolling vitess-24 +1 24.0.5-r9 —
Wolfi rolling wal-g-pg 3.0.9-r13 —
Wolfi rolling wolfictl 0.39.31-r0 —
Wolfi rolling zarf 0.89.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/go-jose/go-jose/v3 <= 3.0.5 — GHSA-vvm8-gf78-28g4
Go github.com/go-jose/go-jose/v4 < 4.1.5 4.1.5 GHSA-vvm8-gf78-28g4

Advisories 6

References