Go JOSE: Panics in JSON parsing

影響: go:github.com/go-jose/go-jose/v4 < 4.1.5 → 4.1.5, go:github.com/go-jose/go-jose/v3 <= 3.0.5

Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed. Workarounds Reject large inputs before parsing them. Acknowledgements Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to pa…

在 GitHub Advisory Database 阅读

2026/10/29 06:14，GitHub Advisory Database 发布了“Go JOSE: Panics in JSON parsing”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub。CVE：CVE-2026-116586。