Go JOSE CVE-2026-116585

The affected application must call go-jose's ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact to decrypt attacker-controlled JWE ciphertext AND must include one of the CBC-HMAC content-encryption algorithms (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) in its accepted ContentEncryption list. If the application does not use these CBC-HMAC modes, it is not exploitable. Vendor-stated workaround (for v4 users): omit these algorithms from the ContentEncryption list passed to the Parse functions; otherwise upgrade to v4.1.5. Limiting factors: exploitation requires that the app actually decrypts untrusted/external ciphertext (not just internally trusted tokens) and that CBC-HMAC algorithms are enabled - applications restricted to AES-GCM or other content algorithms are unaffected. The v3 line (<= 3.0.5) has no fixed version available per the advisory.

This is a denial-of-service vulnerability in the go-jose Go library (CWE-129, improper validation of array index) that is best characterized as a genuine but moderate-priority issue rather than a critical emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with impact limited to VA:L confirms a remotely reachable, unauthenticated, low-complexity trigger whose only consequence is partial availability loss - there is no confidentiality or integrity impact, consistent with a panic/crash rather than code execution. The signals are internally consistent and point to low real-world urgency: EPSS is only 0.26% (18th percentile), the CVE is NOT on CISA KEV, and no public exploit or weaponized PoC is identified in the input (only the fix PR, commit, and a regression test are referenced). The vuln.today decision label is 'this_month,' which aligns with a patch-on-normal-cycle posture rather than act_now/emergency. Note one nuance the input does not resolve: the vendor rated availability as Low (VA:L), but an unrecovered Go panic can crash an entire process, so the practical availability impact depends on whether the consuming application recovers panics per-request - verify against your own deployment. Bottom line: a real, easily triggered DoS worth patching promptly, but not a high-real-risk crisis given no exploitation evidence and availability-only impact.

An attacker sends a crafted JWE token with an empty ciphertext buffer to an application endpoint that decrypts untrusted tokens using A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 content encryption. During CBC-HMAC unpadding the empty buffer is indexed, triggering a panic and denial of service. No public working exploit is identified at time of analysis; only the fix commit and a regression test are referenced, and the trigger (empty ciphertext passed to unpadding) is clearly described by the vendor advisory and PR.