CVE-2026-116587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116587", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-26T15:03:39.036Z", "datePublished": "2026-10-26T21:12:21.326Z", "dateUpdated": "2026-10-27T14:17:50.939Z"}, "containers": {"cna": {"title": "Go JOSE: DoS when parsing JWKs that contain RSA keys", "problemTypes": [{"descriptions": [{"cweId": "CWE-407", "lang": "en", "description": "CWE-407: Inefficient Algorithmic Complexity", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"}, {"name": "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230"}, {"name": "https://github.com/go-jose/go-jose/releases/tag/v4.1.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/go-jose/go-jose/releases/tag/v4.1.6"}], "affected": [{"vendor": "go-jose", "product": "go-jose", "versions": [{"version": "< 4.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T21:12:21.326Z"}, "descriptions": [{"lang": "en", "value": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6."}], "source": {"advisory": "GHSA-mgcc-cww5-fp2q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-27T13:45:58.881401Z", "id": "CVE-2026-116587", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-27T14:17:50.939Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-27T13:45:58.881401Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-27T13:45:59.954Z"}}], "cna": {"title": "Go JOSE: DoS when parsing JWKs that contain RSA keys", "source": {"advisory": "GHSA-mgcc-cww5-fp2q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "go-jose", "product": "go-jose", "versions": [{"status": "affected", "version": "< 4.1.6"}]}], "references": [{"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q", "name": "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230", "name": "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/go-jose/go-jose/releases/tag/v4.1.6", "name": "https://github.com/go-jose/go-jose/releases/tag/v4.1.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-407", "description": "CWE-407: Inefficient Algorithmic Complexity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-26T21:12:21.326Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116587", "state": "PUBLISHED", "dateUpdated": "2026-10-27T14:17:50.939Z", "dateReserved": "2026-10-26T15:03:39.036Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-26T21:12:21.326Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "go-jose", "vendor": "go-jose", "versions": [{"status": "affected", "version": "< 4.1.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6."}], "id": "CVE-2026-116587", "lastModified": "2026-10-27T15:16:40.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116587", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-27T13:45:58.881401Z", "version": "2.0.3"}}]}, "published": "2026-10-26T22:16:55.193", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-jose/go-jose/releases/tag/v4.1.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-407"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "id": "2561215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561215"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.", "A flaw was found in go-jose. A remote attacker can cause a Denial of Service (DoS) by supplying a crafted JSON Web Key (JWK) with oversized or degenerate RSA cryptographic parameters. Because the library fails to enforce size and consistency bounds prior to validation, processing these malicious keys consumes excessive CPU resources and can lead to an application hang or crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-116587", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/kube-rbac-proxy-mce-rhel9", "product_name": "Multicluster Engine for Kubernetes"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Not affected", "package_name": "openshift-service-mesh/kiali-operator-bundle", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Not affected", "package_name": "openshift-service-mesh/kiali-rhel9", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:service_mesh:3", "fix_state": "Will not fix", "package_name": "openshift-service-mesh/kiali-rhel9-operator", "product_name": "OpenShift Service Mesh 3"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/kube-rbac-proxy-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-api-server-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-api-server-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-csr-approver-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-csr-approver-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-node-agent-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-orchestrator-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-agent-installer-orchestrator-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-kube-rbac-proxy-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-openshift-controller-manager-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-26T21:12:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116587\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116587\nhttps://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230\nhttps://github.com/go-jose/go-jose/releases/tag/v4.1.6\nhttps://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"], "statement": "This vulnerability is rated as having an Important severity for Red Hat products because an unauthenticated remote attacker can trigger significant CPU resource exhaustion and service disruption by submitting untrusted JSON Web Keys to exposed endpoints. In environments running affected OpenShift and Kubernetes management components, processing these malformed cryptographic keys can saturate compute capacity and degrade critical control-plane services. The impact is limited to availability, as the issue does not allow data alteration or privilege escalation.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.1.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "go-jose", "source": "cna", "vendor": "go-jose"}, "product": "go-jose", "vendor": "go-jose"}], "created": "2026-10-26T23:45:14.382100+00:00", "updated": "2026-10-27T01:15:17.364726+00:00", "vendors": ["go-jose", "go-jose$PRODUCT$go-jose"]}