CLEANSTART-2026-KZ66366: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required.

Q: What security impact is indicated by the supplied severity data?

The vector indicates no confidentiality or integrity impact and a low availability impact. The reported severity is medium, with a score of 6.9.

Published Nov 6, 2026

Updated

Security vulnerability affects the restic package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

Affected Software

1 affected componentFixes available

cleanstart/restic<0.18.1-r13

0.18.1-r13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/restic to a version that resolves this vulnerability.
Fixed in 0.18.1-r13

Event History

Nov 6, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116585

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required.

What security impact is indicated by the supplied severity data?

The vector indicates no confidentiality or integrity impact and a low availability impact. The reported severity is medium, with a score of 6.9.

CLEANSTART-2026-KZ66366: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What security impact is indicated by the supplied severity data?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What security impact is indicated by the supplied severity data?