GHSA-4w3g-jfj2-cw2q

Dashboard / Vulnerabilities / GHSA-4w3g-jfj2-cw2q

GHSA-4w3g-jfj2-cw2q

Summary: Go JOSE: Panic during CBC-HMAC processing

Details: ### Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. ### Details Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292. ### Workarounds If the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact. ### Impact Denial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected. ### Acknowledgements Thanks to Joshua Rogers of AISLE Research for reporting this problem.

References: https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q, https://nvd.nist.gov/vuln/detail/CVE-2026-116585, https://github.com/go-jose/go-jose/pull/292, https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6, https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54, https://github.com/go-jose/go-jose, https://github.com/go-jose/go-jose/releases/tag/v4.1.5