CyberSecBulletin

Go-jose vulnerabilities

We track 2 vulnerabilities in Go-jose products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Go-jose vulnerabilities

  • 7.5 High severity

    go-jose: Inefficient Algorithmic Complexity

    CVE-2026-116587Go-jose

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-co

  • 7.5 High severity

    go-jose: Uncaught Exception

    CVE-2026-34986Go-jose

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSO