GHSA-4w3g-jfj2-cw2q

Source

https://github.com/advisories/GHSA-4w3g-jfj2-cw2q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4w3g-jfj2-cw2q/GHSA-4w3g-jfj2-cw2q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4w3g-jfj2-cw2q

Aliases

CVE-2026-116585

Downstream

CGA (8)

Published

2026-10-28T21:14:00Z

Modified

2026-10-28T21:30:06Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Go JOSE: Panic during CBC-HMAC processing

Details

Summary

Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input.

Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.

Details

Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292.

Workarounds

If the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact.

Impact

Denial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected.

Acknowledgements

Thanks to Joshua Rogers of AISLE Research for reporting this problem.

Database specific

{
    "cwe_ids":  [
        "CWE-129"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-28T21:14:00Z",
    "nvd_published_at":  "2026-10-26T22:16:54Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/go-jose/go-jose/v4

Package

Name: github.com/go-jose/go-jose/v4; View open source insights on deps.dev
Purl: pkg:golang/github.com/go-jose/go-jose/v4

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.1.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4w3g-jfj2-cw2q/GHSA-4w3g-jfj2-cw2q.json"

Go / github.com/go-jose/go-jose/v3

Package

Name: github.com/go-jose/go-jose/v3; View open source insights on deps.dev
Purl: pkg:golang/github.com/go-jose/go-jose/v3

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.0.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4w3g-jfj2-cw2q/GHSA-4w3g-jfj2-cw2q.json"