GHSA-vvm8-gf78-28g4: Go/github.com/go-jose/go-jose/v3 vulnerability

Q: Which applications are exposed to this denial-of-service issue?

Any application that parses untrusted JSON using go-jose is exposed. An attacker can provide deeply nested JSON that causes parsing to reach Go's stack limit and crash the application.

Q: What can be done if patching cannot happen immediately?

Reject large inputs before parsing them. This reduces exposure to attacker-controlled JSON payloads that may be deeply nested.

Published Oct 28, 2026

Updated

Summary

Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.

Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.

Impact

Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.

Workarounds

Reject large inputs before parsing them.

Acknowledgements

Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.

Affected Software

2 affected componentsFixes available

go/github.com/go-jose/go-jose/v3<=3.0.5

go/github.com/go-jose/go-jose/v4<4.1.5

4.1.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/go-jose/go-jose/v4 to a version that resolves this vulnerability.
Fixed in 4.1.5
Compensating control
Reject large untrusted JSON inputs before parsing them with go-jose.

Event History

Oct 28, 2026

Advisory Published

via GitHub·09:14 PM

Data Sourced

via GitHub·09:14 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

Which applications are exposed to this denial-of-service issue?

Any application that parses untrusted JSON using go-jose is exposed. An attacker can provide deeply nested JSON that causes parsing to reach Go's stack limit and crash the application.

What can be done if patching cannot happen immediately?