Denial of Service Vulnerability in Go JOSE for JS Object Signing and Encryption by Affected Vendor

CVE-2026-34986

What is CVE-2026-34986?

The Go JOSE library, which implements JavaScript Object Signing and Encryption standards, contains a vulnerability that can lead to a denial of service condition. Specifically, prior to versions 4.1.4 and 3.0.5, decrypting a JSON Web Encryption object can cause a panic if the 'alg' field specifies a key wrapping algorithm and the 'encrypted_key' field is empty. This panic occurs during key unwrapping when attempting to allocate a slice with an invalid length, rendering the application unresponsive. The vulnerability can be triggered through specific parsing functions or, less commonly, by calling the key unwrapping function directly with unsuitable parameters. Affected users are urged to upgrade to the latest versions to mitigate this risk.

References