go-jose vulnerabilities

The go-jose library before version 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on these architectures.

The go-jose library before version 1.0.4 is vulnerable to an invalid curve attack in the ECDH-ES algorithm. When deriving a shared key, go-jose fails to check that the received public key is on the same curve as the receiver's static private key.

Go JOSE, a Go implementation of the JOSE standards (JWE, JWS, JWT), prior to 4.1.6 parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make validation consume cubic CPU time, allowing remote denial of service.

Prior to version 4.1.5, go-jose does not limit nesting depth when parsing attacker-controlled JSON. Deeply nested arrays or objects exceed Go's stack limit, causing a stack overflow and application crash.

Prior to version 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 in go-jose can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows indexing of the empty buffer, causing a panic and denial of service.

Go JOSE prior to versions 4.1.4 and 3.0.5 has a vulnerability where decrypting a JWE object can panic if the alg field indicates a key wrapping algorithm (ending in KW, except A128GCMKW, A192GCMKW, A256GCMKW) and the encrypted_key field is empty. The panic occurs when attempting to allocate a slice with zero or negative length. This can lead to denial of service.