{"id":"CVE-2026-116586","aliases":["GHSA-vvm8-gf78-28g4"],"title":"Go JOSE: Panics in JSON parsing","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\n\nParsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.\n\nNote: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.\n\n### Impact\n\nDenial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.\n\n### Workarounds\n\nReject large inputs before parsing them.\n\n### Acknowledgements\n\nThanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.","severity":"medium","score":6.9,"published":"2026-10-26T21:09:26.349Z","modified":"2026-10-28T21:30:05.801Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"github.com/go-jose/go-jose/v4","sources":[{"name":"OSV · GHSA-vvm8-gf78-28g4","url":"https://osv.dev/vulnerability/GHSA-vvm8-gf78-28g4"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.1.5"}],"type":"SEMVER"}],"versions":[],"fixed":["4.1.5"]},{"ecosystem":"Go","name":"github.com/go-jose/go-jose/v3","sources":[{"name":"OSV · GHSA-vvm8-gf78-28g4","url":"https://osv.dev/vulnerability/GHSA-vvm8-gf78-28g4"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"3.0.5"}],"type":"SEMVER"}],"versions":[],"fixed":[]}],"sourceAffected":[],"references":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose"],"sources":[{"name":"CVE","id":"CVE-2026-116586","modified":"2026-10-26T21:09:26.349Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116586"},{"name":"OSV","id":"GHSA-vvm8-gf78-28g4","modified":"2026-10-28T21:30:05.801821772Z","url":"https://osv.dev/vulnerability/GHSA-vvm8-gf78-28g4"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9}],"products":[{"vendor":"go-jose","name":"go-jose","platforms":[],"versions":[{"version":"< 4.1.5","status":"affected"}],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-116586"}],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T04:15:31.644Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T22:25:39.765Z","attemptedAt":"2026-10-28T22:25:39.765Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T22:25:40.848Z","attemptedAt":"2026-10-28T22:25:40.848Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T22:25:40.271Z","attemptedAt":"2026-10-28T22:25:40.271Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T22:25:39.946Z","attemptedAt":"2026-10-28T22:25:39.946Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-116586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","modified":"2026-10-27T15:08:50.630","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-28T22:25:39.765Z"},{"source":"FIRST EPSS","id":"CVE-2026-116586","url":"https://www.first.org/epss/","probability":0.00292,"percentile":0.21679,"date":"2026-10-28","checkedAt":"2026-10-28T22:25:39.946Z"},{"source":"ENISA EUVD","id":"EUVD-2026-110466","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110466","modified":"Oct 28, 2026, 9:14:08 PM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-10-28T22:25:40.271Z"},{"source":"GitHub Advisory Database","id":"GHSA-vvm8-gf78-28g4","url":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","modified":"2026-10-28T21:14:09Z","checkedAt":"2026-10-28T22:25:40.848Z"}]}