{"id":"ghsa-ghsa-mgcc-cww5-fp2q","seq":1708768,"kind":"advisory","title":"Go JOSE: DoS when parsing JWKs that contain RSA keys","url":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","permalink":"https://vulnpulse.app/items/ghsa-ghsa-mgcc-cww5-fp2q","summary":"影響: go:github.com/go-jose/go-jose/v4 <= 4.1.5 → 4.1.6, go:github.com/go-jose/go-jose/v3 <= 3.0.5\nA crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU. https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#…","severity":"high","techs":["go","github"],"cves":["CVE-2026-116587"],"tags":["GHSA-mgcc-cww5-fp2q","github.com/go-jose/go-jose/v4","github.com/go-jose/go-jose/v3"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T19:01:30.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}