go-jose has 4 CVEs on record between 2023 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.9 (medium). Most affected products: github.com/go-jose/go-jose/v4 (3), github.com/go-jose/go-jose/v3 (1).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- github.com/go-jose/go-jose/v4 3
- github.com/go-jose/go-jose/v3 1
4
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-116587High· 7.5Go JOSE: DoS when parsing JWKs that contain RSA keys41CVE-2026-116586Medium· 6.9Go JOSE: Panics in JSON parsing38CVE-2026-116585Medium· 6.9Go JOSE: Panic during CBC-HMAC processing38GHSA-2c7c-3mj9-8fqhMediumDecryption of malicious PBES2 JWE objects can consume unbounded system resources28
go-jose vulnerabilities
CVEs affecting go-jose, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-116586Medium· 6.9Go JOSE: Panics in JSON parsing
Go JOSE: Panics in JSON parsing
▾ Sunlitgo-jose · github.com/go-jose/go-jose/v4EPSS 0.29%via GHSA
CVE-2026-116585Medium· 6.9Go JOSE: Panic during CBC-HMAC processing
Go JOSE: Panic during CBC-HMAC processing
▾ Sunlitgo-jose · github.com/go-jose/go-jose/v4EPSS 0.26%via GHSA
CVE-2026-116587High· 7.5Go JOSE: DoS when parsing JWKs that contain RSA keys
Go JOSE: DoS when parsing JWKs that contain RSA keys
▾ Twilightgo-jose · github.com/go-jose/go-jose/v4EPSS 0.37%via OSV
GHSA-2c7c-3mj9-8fqhMediumDecryption of malicious PBES2 JWE objects can consume unbounded system resources
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
▾ Sunlitgo-jose · github.com/go-jose/go-jose/v3via OSV