{"id":"CVE-2026-116585","aliases":["GHSA-4w3g-jfj2-cw2q"],"title":"Go JOSE: Panic during CBC-HMAC processing","summary":"Go JOSE: Panic during CBC-HMAC processing","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","vendor":"go-jose","product":"github.com/go-jose/go-jose/v4","ecosystem":"go","affected":["github.com/go-jose/go-jose/v4 < 4.1.5","github.com/go-jose/go-jose/v3 <= 3.0.5"],"patched":["github.com/go-jose/go-jose/v4 4.1.5"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T21:30:06.790863342Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4w3g-jfj2-cw2q","references":[{"url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585"},{"url":"https://github.com/go-jose/go-jose/pull/292"},{"url":"https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6"},{"url":"https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54"},{"url":"https://github.com/go-jose/go-jose"},{"url":"https://github.com/go-jose/go-jose/releases/tag/v4.1.5"},{"url":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q"}],"tags":["osv","go","ghsa","cve.org"],"epss":0.00264,"epssPercentile":0.18342,"cvssSource":"cna","cwe":["CWE-129"],"ingestedAt":"2026-10-27T16:11:59.115Z","slug":"CVE-2026-116585","body":"## Overview\n\n### Summary\n\nDecrypting a ciphertext with \"A128CBC-HS256\", \"A192CBC-HS384\", or \"A256CBC-HS512\" can result in a panic on untrusted input.\n\nNote this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.\n\n### Details\n\nInsufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292.\n\n### Workarounds\n\nIf the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact.\n\n### Impact\n\nDenial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected.\n\n### Acknowledgements\n\nThanks to Joshua Rogers of AISLE Research for reporting this problem.\n\n## Affected packages\n\n- `github.com/go-jose/go-jose/v4 < 4.1.5`\n- `github.com/go-jose/go-jose/v3 <= 3.0.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/go-jose/go-jose/v4 4.1.5`","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}