—
GO-2026-4945
Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose
Details
The go-jose package is subject to a panic when decrypting certain JSON Web Encryption (JWE) tokens. This occurs when an attacker can provide a maliciously crafted JWE token that triggers an unhandled exception during the decryption process, leading to a denial-of-service.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/go-jose/go-jose/v3
Introduced in:
0 Fixed in: 3.0.5 Fix
go get github.com/go-jose/go-jose/v3@v3.0.5 Go / github.com/go-jose/go-jose/v4
Introduced in:
0 Fixed in: 4.1.4 Fix
go get github.com/go-jose/go-jose/v4@v4.1.4