{"id":"GO-2026-4945","revision":"808d5eb62ba54581a867b8e9160d60dc","records":[{"revision":"808d5eb62ba54581a867b8e9160d60dc","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4945","aliases":["CVE-2026-34986","GHSA-78h2-9frx-2jm8"],"title":"Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose","description":"The go-jose package is subject to a panic when decrypting certain JSON Web Encryption (JWE) tokens. This occurs when an attacker can provide a maliciously crafted JWE token that triggers an unhandled exception during the decryption process, leading to a denial-of-service.","state":0,"publishedAt":"2026-05-26T22:49:18+00:00","modifiedAt":"2026-06-01T21:14:16.019255+00:00","affected":[{"ecosystem":"Go","name":"github.com/go-jose/go-jose/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.0.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/go-jose/go-jose/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.1.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4945","license":"OSV · upstream source license applies","key":"osv:GO-2026-4945","identifiers":["GO-2026-4945","CVE-2026-34986","GHSA-78h2-9frx-2jm8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}