EUVD-2026-110467
GHSA-mgcc-cww5-fp2q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint parsing untrusted JWKs
-
DeliveryCraft JWK with oversized/degenerate RSA modulus and primes
-
ExploitSubmit crafted JWS/JWE or JWK
-
Executiongo-jose calls rsa.PrivateKey.Validate (cubic CPU)
-
ImpactCPU exhaustion, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Requires that the application uses go-jose to parse JWKs from untrusted sources - for example calling ParseSigned/ParseEncrypted on messages whose protected header embeds a 'jwk', or unmarshaling attacker-supplied JWK/JWK Sets - AND that the application runs on Go 1.24 or later, where crypto/rsa.PrivateKey.Validate exhibits cubic time on crafted modulus/prime values. The vendor states no special go-jose configuration is required to trigger it. Limiting factors: deployments that never ingest attacker-controlled JWKs are not exposed, and the cubic-cost amplification is specific to Go 1.24+; only availability is affected (no data exposure or integrity loss). Affected: go-jose/v4 <= 4.1.5 (fixed 4.1.6) and go-jose/v3 <= 3.0.5 (not yet patched). |
| Impact | Signals are internally consistent and point to a genuine but moderate-urgency availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a remotely reachable, unauthenticated, low-complexity flaw with availability-only impact and no confidentiality or integrity loss - classic CWE-407 algorithmic-complexity DoS (the advisory also cites CWE-770, missing bounds). The EPSS score of 0.37% (30th percentile) is low, and CISA KEV does not list it (SSVC Exploitation: none), so there is no evidence of active exploitation; however, the vendor GHSA publishes a full working proof-of-concept and SSVC marks the issue Automatable: yes with Technical Impact: partial, which is why the vuln.today priority is 'this_week' rather than a routine backlog item. The signals do not conflict: a published PoC plus automatable triggering explains the this_week label, while low EPSS and no KEV explain why it is not act_now/emergency. The practical ceiling on risk is that only applications parsing JWKs from untrusted sources, running on Go 1.24+, are affected - so raw CVSS network reach overstates exposure for deployments that never ingest attacker-controlled keys. |
| Exploit ScenarioDerived | An attacker sends a signed or encrypted JOSE message (or a JWK/JWK Set) containing an embedded RSA key with a crafted oversized or degenerate modulus and prime values to any endpoint that parses JWKs from untrusted input using go-jose. On Go 1.24+, go-jose passes these unbounded values to crypto/rsa.PrivateKey.Validate, which consumes cubic CPU time, stalling the worker and denying service. A fully working proof-of-concept is published in the vendor's GHSA advisory and requires no special go-jose configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Denial of service in the Go JOSE library (go-jose) allows remote attackers to burn excessive CPU by supplying a JWK containing crafted RSA parameters, because versions up to 4.1.5 pass the attacker-controlled modulus and primes straight into crypto/rsa.PrivateKey.Validate, which on Go 1.24+ runs in cubic time relative to the size of those values. Any service that calls ParseSigned, ParseEncrypted or unmarshals untrusted JWK/JWK Set data on a Go 1.24+ toolchain is exposed; exposures are limited to availability (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), and the issue is not known to be exploited (CISA SSVC exploitation: none; EPSS 0.37%, 30th percentile). The vendor advisory ships a public proof-of-concept reproducer; go-jose/v4 is fixed in 4.1.6, while the v3 branch (<= 3.0.5) has no patched release yet, and the current priority signal places remediation in this week's patch cycle.
RemediationAI
Vendor-released patch: go-jose/v4 4.1.6 (upgrade the module to github.com/go-jose/go-jose/v4 v4.1.6, see https://github.com/go-jose/go-jose/releases/tag/v4.1.6 and the fix commit https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230). Applications that legitimately use RSA keys larger than the new 4096-bit default must set go-jose's exported MaxRSAModulusBits before any parsing occurs, accepting a corresponding increase in validation cost. For the v3 branch (<= 3.0.5) no fixed release is identified, so until one ships the practical control is to stop feeding untrusted key material into the library: do not accept JWKs embedded in message headers or JWK Sets from remote parties, and instead pin keys server-side or resolve them only from a trusted store - the trade-off is loss of interoperability with peers that rely on embedded or dynamically supplied keys. Deployments on Go versions earlier than 1.24 do not exhibit the cubic validation cost but should still upgrade, since the missing bounds checks are the underlying defect. Per the current priority signal, schedule this upgrade in this week's patch cycle rather than as an emergency change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
go-jose implements JWS, JWE and JWT for Go, and its JWK parser accepts RSA key material as base64url-encoded big integers (n, e, and for private keys d, p, q, dp, dq, qi). The parser performed no size or consistency checks before constructing a crypto/rsa.PrivateKey and calling its Validate() method, so a message whose protected header embeds a 'jwk' (or an attacker-supplied JWK document) could carry an arbitrarily large or arithmetically inconsistent prime. On Go 1.24 and later, that validation path exhibits cubic time complexity in the modulus and prime sizes, giving an algorithmic-complexity denial of service (CWE-407, with the advisory also classifying it as CWE-770 resource exhaustion). The upstream fix (commit a0111f8) introduces an exported MaxRSAModulusBits limit defaulting to 4096 bits, rejects private keys whose primes do not multiply back to the modulus (p*q != n) or whose combined prime bit length exceeds the modulus, rejects embedded EPK/jwk headers containing private parameters, and reorders JWE header sanitization so an unexpected algorithm is rejected before an embedded key is parsed. The trigger is message parsing rather than signature verification or cryptographic misuse; the advisory states no special go-jose configuration is required to reproduce it.
Know when Go Jose gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, unauthenticated parsing of attacker-controlled JWKs with no user interaction (AV:N/AC:L/PR:N/UI:N); availability-only CPU-exhaustion impact (A:H, C:N/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.
Executive ViewAI
The Go JOSE library (go-jose) contains a high-severity denial-of-service vulnerability that allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted RSA keys, potentially disrupting any service that processes untrusted JSON Web Keys on Go 1.24 or later. This affects availability of authentication and encryption services across applications using the library, and while no active exploitation has been observed, a public proof-of-concept exists, making it imperative for security management to prioritize remediation to prevent service outages.
For the v3 branch (<= 3.0.5) with no patched release, restrict processing of untrusted JWK data to trusted sources, enforce strict input validation and size limits on RSA parameters, and implement rate limiting or resource quotas on services that parse JWKs to mitigate CPU exhaustion.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. Rated critical severity (CVSS 9.1),
go-jose before 1.0.4 suffers from multiple signatures exploitation. Rated high severity (CVSS 7.5), this vulnerability i
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. Rated high severity (CVSS 7.5), t
Parsing deeply nested JSON through go-jose versions prior to 4.1.5 can exhaust Go's stack limit and crash the process, g
Decrypting untrusted JWE ciphertext in Go JOSE (go-jose) with CBC-HMAC content encryption can pass an empty buffer into
Exploit-DB