{"id":"CVE-2026-116585","aliases":["GHSA-4w3g-jfj2-cw2q"],"url":"https://o3.security/vulnerability/CVE-2026-116585","summary":"Go JOSE: Panic during CBC-HMAC processing","details":"### Summary\n\nDecrypting a ciphertext with \"A128CBC-HS256\", \"A192CBC-HS384\", or \"A256CBC-HS512\" can result in a panic on untrusted input.\n\nNote this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.\n\n### Details\n\nInsufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292.\n\n### Workarounds\n\nIf the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact.\n\n### Impact\n\nDenial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected.\n\n### Acknowledgements\n\nThanks to Joshua Rogers of AISLE Research for reporting this problem.","published":"2026-10-26T21:06:35.189Z","modified":"2026-10-29T02:30:42.598289446Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/go-jose/go-jose/v4","fixedVersion":"4.1.5"},{"ecosystem":"Go","name":"github.com/go-jose/go-jose/v3","fixedVersion":null}],"fix":{"url":"https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","label":"go-jose/go-jose@35883f7"},"references":[{"type":"WEB","url":"https://github.com/go-jose/go-jose/releases/tag/v4.1.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116585.json"},{"type":"ADVISORY","url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585"},{"type":"FIX","url":"https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6"},{"type":"FIX","url":"https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54"},{"type":"FIX","url":"https://github.com/go-jose/go-jose/pull/292"},{"type":"PACKAGE","url":"https://github.com/go-jose/go-jose"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T02:30:42.598289446Z"}}