---
id: CVE-2026-116586
aliases:
  - GHSA-vvm8-gf78-28g4
title: 'Go JOSE: Panics in JSON parsing'
summary: 'Go JOSE: Panics in JSON parsing'
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
vendor: go-jose
product: github.com/go-jose/go-jose/v4
ecosystem: go
affected:
  - github.com/go-jose/go-jose/v4 < 4.1.5
  - github.com/go-jose/go-jose/v3 <= 3.0.5
patched:
  - github.com/go-jose/go-jose/v4 4.1.5
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T21:30:05.801821772Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vvm8-gf78-28g4'
references:
  - url: 'https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-116586'
  - url: 'https://github.com/go-jose/go-jose/pull/290'
  - url: >-
      https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a
  - url: 'https://github.com/go-jose/go-jose'
  - url: 'https://github.com/go-jose/go-jose/releases/tag/v4.1.5'
  - url: 'https://github.com/advisories/GHSA-vvm8-gf78-28g4'
tags:
  - osv
  - go
  - ghsa
  - cve.org
epss: 0.00292
epssPercentile: 0.2172
cvssSource: cna
cwe:
  - CWE-674
ingestedAt: '2026-10-27T16:11:59.116Z'
---

## Overview

### Summary

Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.

Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.

### Impact

Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.

### Workarounds

Reject large inputs before parsing them.

### Acknowledgements

Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.

## Affected packages

- `github.com/go-jose/go-jose/v4 < 4.1.5`
- `github.com/go-jose/go-jose/v3 <= 3.0.5`

## Remediation

Upgrade to a patched release:

- `github.com/go-jose/go-jose/v4 4.1.5`