Denial of Service Vulnerability in Go JOSE by Affected Vendor

CVE-2026-116585

What is CVE-2026-116585?

The Go JOSE library, which implements multiple encryption standards including JSON Web Encryption (JWE), contains a vulnerability that affects how untrusted ciphertext is decrypted. Prior to version 4.1.5, the library allowed an attacker to trigger a denial of service by exploiting empty ciphertext buffers while using specific content-encryption algorithms (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512). This insufficient validation can lead to application panics when indexing these empty buffers. Users of affected versions should update to 4.1.5 to mitigate this issue.

References