CVE-2026-116587: Go JOSE: DoS when parsing JWKs that contain RSA keys
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go-joseto a version that resolves this vulnerability.Fixed in 4.1.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Go JOSE versions before 4.1.6 are exposed if they parse JWKs from untrusted sources and run on Go 1.24 or later. Applications that do not process attacker-controlled JWK input are not described as affected by this attack path.
What must an attacker provide to trigger the denial of service?
An attacker must cause the application to parse a JWK containing crafted, excessively large or degenerate RSA modulus or prime values. The vulnerable parsing path passes these values to crypto/rsa.PrivateKey.Validate, where validation can consume cubic CPU time on Go 1.24 and later.
Is authentication or user interaction required for exploitation?
No. The supplied vector is network-accessible with low attack complexity, no privileges required, and no user interaction required, provided the attacker can submit or otherwise supply an untrusted JWK to the application.
What version fixes the issue?
Upgrade Go JOSE to version 4.1.6, which adds the fix for this issue.