go-jose EUVD-2026-110466

The affected application must parse attacker-controlled/untrusted JSON through go-jose - i.e., accept externally supplied JWT, JWE, JWS, or raw JSON and pass it to go-jose's parser without first bounding input size or nesting depth. The concrete trigger is a payload with deeply nested arrays or objects that exceeds Go's stack limit. Exploitation is remote and unauthenticated (AV:N/PR:N/UI:N) against affected versions: go-jose/v4 < 4.1.5 (fixed in 4.1.5) and go-jose/v3 <= 3.0.5 (NOT yet patched). What LIMITS exploitation: the application must actually expose a go-jose parsing path to untrusted input; deployments that only process trusted/internal JSON, or that already reject large inputs before parsing (the vendor-stated workaround), are not exposed. Impact is confined to a process crash (availability only).

This is a denial-of-service vulnerability (CWE-674, uncontrolled recursion) with a genuinely moderate real-world risk profile - not a false-high. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, but impact is limited to availability only (VC:N/VI:N/VA:L) with no confidentiality or integrity effect, yielding a 6.9 Medium score. Signals are internally consistent: EPSS is low at 0.29% (22nd percentile), the vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing and no public working exploit - consistent with a bug that is easy to trigger but whose payoff is only a crash. The only mild tension is the VA:L rating: a full application crash is arguably a High availability impact, but the vendor-supplied vector scores it Low, so the practical blast radius (one process crash per malicious request) matches the Low rating. Priority should be driven by exposure rather than severity: environments that parse untrusted JWT/JWE/JWS/JSON through go-jose on an internet-facing path warrant patching this month, while internal-only or trusted-input usage is lower urgency.

An attacker sends a JWT/JWE/JWS or raw JSON payload containing deeply nested arrays or objects to an endpoint that parses it via go-jose. The nested structure exceeds Go's stack limit during scanning, triggering a stack overflow that crashes the process and denies service to legitimate users. No authentication or user interaction is required (AV:N/PR:N/UI:N); no public working exploit is identified, but the trigger (deeply nested JSON) is trivially reproducible.