Denial of Service Vulnerability in Go JOSE by Go

CVE-2026-116587

What is CVE-2026-116587?

Go JOSE, an implementation of the JavaScript Object Signing and Encryption standards in Go, has a vulnerability that affects versions prior to 4.1.6. It allows attacker-controlled RSA modulus and prime values to be parsed from JSON Web Keys (JWKs) without proper validation of their size and consistency. This lack of enforcement can lead to excessive CPU resource consumption during RSA parameter validation, potentially enabling remote denial of service attacks when applications process JWKs from untrusted sources. The issue has been patched in version 4.1.6.

References