Go JOSE: DoS when parsing JWKs that contain RSA keys

影響: go:github.com/go-jose/go-jose/v4 <= 4.1.5 → 4.1.6, go:github.com/go-jose/go-jose/v3 <= 3.0.5

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU. https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 04:01, GitHub Advisory Database에서 "Go JOSE: DoS when parsing JWKs that contain RSA keys"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-116587.