VDB
KO

GO-2026-4945

Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose

Details

The go-jose package is subject to a panic when decrypting certain JSON Web Encryption (JWE) tokens. This occurs when an attacker can provide a maliciously crafted JWE token that triggers an unhandled exception during the decryption process, leading to a denial-of-service.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/go-jose/go-jose/v3
Introduced in: 0 Fixed in: 3.0.5
Fix go get github.com/go-jose/go-jose/v3@v3.0.5
Go / github.com/go-jose/go-jose/v4
Introduced in: 0 Fixed in: 4.1.4
Fix go get github.com/go-jose/go-jose/v4@v4.1.4

References