MEDIUM5.3Go
GHSA-7f9x-gw85-8grf· CVE-2023-49290, GO-2023-2379lestrrat-go/jwx's malicious parameters in JWE can cause a DOS
Modified: 9/10/2026
package
Go/github.com/lestrrat-go/jwx
pkg:go/github.com/lestrrat-go/jwx
MEDIUM6.8Go
GHSA-hj3v-m684-v259· CVE-2024-28122, GO-2024-2632JWX vulnerable to a denial of service attack using compressed JWE message
Modified: 9/10/2026
MEDIUM4.3Go
GHSA-pvcr-v8j8-j5q3· CVE-2024-21664, GO-2024-2454Parsing JSON serialized payload without protected field can lead to segfault
Modified: 9/10/2026
MEDIUMGo
GHSA-rm8v-mxj3-5rmq· GO-2023-1859github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack
Modified: 11/8/2023
—Go
GO-2023-1859· GHSA-rm8v-mxj3-5rmqPadding oracle vulnerability in github.com/lestrrat-go/jwx
Modified: 5/20/2024
—Go
GO-2023-2379· CVE-2023-49290, GHSA-7f9x-gw85-8grfDenial of service due to malicious parameters in github.com/lestrrat-go/jwx
Modified: 2/4/2026
—Go
GO-2024-2454· CVE-2024-21664, GHSA-pvcr-v8j8-j5q3Panic due to nil pointer dereference in github.com/lestrrat-go/jwx/v2
Modified: 2/4/2026
—Go
GO-2024-2632· CVE-2024-28122, GHSA-hj3v-m684-v259JWX vulnerable to a denial of service attack using compressed JWE message in github.com/lestrrat-go/jwx
Modified: 2/4/2026