Denial of Service Vulnerability in Go JOSE Implementation for JSON Standards

CVE-2026-116586

What is CVE-2026-116586?

The Go JOSE library, utilized for implementing various JSON standards, has a vulnerability that allows attacker-controlled JSON to cause deeply nested arrays or objects to exceed the stack limit in Go. This could lead to a stack overflow, crashing the application and resulting in a denial of service when dealing with untrusted JSON input. The issue has been addressed in version 4.1.5, where parsing improvements were made to mitigate the risk.

References