{"id":"ghsa-ghsa-4w3g-jfj2-cw2q","seq":2056934,"kind":"advisory","title":"Go JOSE: Panic during CBC-HMAC processing","url":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","permalink":"https://vulnpulse.app/items/ghsa-ghsa-4w3g-jfj2-cw2q","summary":"影響: go:github.com/go-jose/go-jose/v4 < 4.1.5 → 4.1.5, go:github.com/go-jose/go-jose/v3 <= 3.0.5\nDecrypting a ciphertext with \"A128CBC-HS256\", \"A192CBC-HS384\", or \"A256CBC-HS512\" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Details Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292. Workarounds If the application does not require the CBC-HMAC modes for content encryption, and is using github.com/g…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-116585"],"tags":["GHSA-4w3g-jfj2-cw2q","github.com/go-jose/go-jose/v4","github.com/go-jose/go-jose/v3"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:14:00.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}