CVE-2026-116586 in go-jose
Summary
by MITRE • 10/27/2026
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within the go-jose library, a widely used implementation of the JOSE standards for JavaScript Object Signing and Encryption, represents a critical resource exhaustion flaw rooted in improper input validation during JSON parsing operations. The core technical issue stems from the library's handling of deeply nested data structures, specifically arrays or objects contained within untrusted JSON payloads. When an attacker crafts a maliciously constructed JSON document with excessive nesting levels, the underlying Go runtime attempts to process this structure by allocating stack space for each level of recursion or iteration required to parse the hierarchy. Because go-jose prior to version 4.1.5 did not enforce strict limits on the depth of these nested structures, it allowed inputs that exceeded the default stack size limitations inherent to the Go programming language environment. This lack of boundary checking transforms a standard parsing operation into an unbounded resource consumption event, directly triggering a stack overflow condition within the application executing the library code.
From an operational perspective, this vulnerability facilitates a straightforward denial of service attack against any application that relies on go-jose to process external or user-supplied JSON data without sufficient pre-validation. The immediate impact is the abrupt termination of the affected process due to the runtime panic caused by the stack overflow. In web server contexts or microservice architectures where such parsing occurs frequently, this can lead to service unavailability for legitimate users. If the application is not configured with robust restart mechanisms or if it operates in a stateful manner that cannot be easily recovered from a crash, the availability impact extends beyond simple downtime to potential data loss or corruption of ongoing transactions. The attack vector requires only network access to send the crafted JSON payload, making it remotely exploitable by any actor who can interact with the service endpoint responsible for parsing JOSE-compliant tokens such as JWTs or JWE messages.
This flaw aligns closely with CWE-787: Out-of-bounds Write and more specifically CWE-400: Uncontrolled Resource Consumption, as the primary failure mode is the exhaustion of system resources leading to a crash rather than arbitrary code execution in this specific instance. In terms of offensive security frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1499: Endpoint Denial of Service, where an adversary leverages software vulnerabilities to disrupt service availability. The exploitation does not require complex privilege escalation or lateral movement; it is a direct application-layer attack that targets the robustness of input parsing routines. Security architects must recognize that libraries handling cryptographic standards often assume well-formed inputs and may lack defensive programming practices against malformed data, making external validation layers essential even when using trusted third-party components.
Mitigation strategies for this vulnerability are primarily centered around immediate software updates and architectural hardening. The definitive remediation is to upgrade the go-jose dependency to version 4.1.5 or later, where developers have implemented safeguards to limit nesting depth during JSON parsing operations. For environments where an immediate patch is not feasible, organizations should implement input validation at the network perimeter using Web Application Firewalls that detect and block excessively deep JSON structures based on size or complexity heuristics. Additionally, application-level defenses can be introduced by wrapping the go-jose parsing functions with custom error handlers that catch panics and gracefully degrade service availability rather than crashing entirely. It is also advisable to enforce strict schema validation on incoming JWTs and JWE payloads before they are passed to the cryptographic libraries, ensuring that only expected data structures reach the vulnerable code paths. Regular dependency audits using tools like govulncheck should be integrated into CI/CD pipelines to proactively identify such library vulnerabilities before they can be exploited in production environments.