UBUNTU-CVE-2026-116586: Medium severity ubuntu/golang-gopkg-square-go-jose.v2 vulnerability
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go-joseto a version that resolves this vulnerability.Fixed in 4.1.5
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service issue?
Applications using affected go-jose versions are exposed if they parse JSON supplied by an untrusted party through go-jose. The affected Ubuntu package names listed are golang-gopkg-square-go-jose.v2, golang-github-go-jose-go-jose, and golang-github-go-jose-go-jose.v3.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network access, low attack complexity, no privileges, and no user interaction are required. An attacker needs to provide deeply nested JSON that is parsed through go-jose.
What is the impact of successful exploitation?
Deeply nested arrays or objects can exceed Go's stack limit, causing a stack overflow and crashing the application. The stated impact is denial of service.
What version contains the fix?
The issue is fixed in go-jose version 4.1.5.