Aller au contenu
en Se connecter
6.9 Moyenne

CVE-2026-116585 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…

Description

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.

Produits et versions touchés

Produit Versions touchées Corrigé en
go-jose 4.1 premières → < 4.1.5 4.1.5

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de go-jose

Les 6 CVE de go-jose →
CVE-2026-116587 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including… 7.5 Élevée CVE-2026-116586 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including… 6.9 Moyenne CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including… 7.5 Élevée CVE-2025-27144 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including… 6.6 Moyenne
Suivre cette CVE