Repository navigation
deps(deps): update module github.com/go-jose/go-jose/v4 to v4.1.4 [security] - #496
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
…curity] Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.0.2→v4.1.4DoS in go-jose Parsing
CVE-2025-27144 / GHSA-c6gw-w398-hv78
More information
Details
Impact
When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.
Patches
Version 4.0.5 fixes this issue
Workarounds
Applications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters.
References
This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Go JOSE Panics in JWE decryption
CVE-2026-34986 / GHSA-78h2-9frx-2jm8
More information
Details
Impact
Decrypting a JSON Web Encryption (JWE) object will panic if the
algfield indicates a key wrapping algorithm (one ending inKW, with the exception ofA128GCMKW,A192GCMKW, andA256GCMKW) and theencrypted_keyfield is empty. The panic happens whencipher.KeyUnwrap()inkey_wrap.goattempts to allocate a slice with a zero or negative length based on the length of theencrypted_key.This code path is reachable from
ParseEncrypted()/ParseEncryptedJSON()/ParseEncryptedCompact()followed byDecrypt()on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected.This panic is also reachable by calling
cipher.KeyUnwrap()directly with anyciphertextparameter less than 16 bytes long, but calling this function directly is less common.Panics can lead to denial of service.
Fixed In
4.1.4 and v3.0.5
Workarounds
If the list of
keyAlgorithmspassed toParseEncrypted()/ParseEncryptedJSON()/ParseEncryptedCompact()does not include key wrapping algorithms (those ending inKW), your application is unaffected.If your application uses key wrapping, you can prevalidate to the JWE objects to ensure the
encrypted_keyfield is nonempty. If your application accepts JWE Compact Serialization, apply that validation to the corresponding field of that serialization (the data between the first and second.).Thanks
Thanks to Datadog's Security team for finding this issue.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
go-jose/go-jose (github.com/go-jose/go-jose/v4)
v4.1.4Compare Source
What's Changed
Fixes Panic in JWE decryption. See GHSA-78h2-9frx-2jm8
Full Changelog: go-jose/go-jose@v4.1.3...v4.1.4
v4.1.3Compare Source
This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop
x/cryptoand no longer have any external dependencies in go-jose outside of the standard library!This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.
What's Changed
Full Changelog: go-jose/go-jose@v4.1.2...v4.1.3
v4.1.2Compare Source
What's Changed
go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.
New Contributors
Full Changelog: go-jose/go-jose@v4.1.1...v4.1.2
v4.1.1Compare Source
What's Changed
New Contributors
Full Changelog: go-jose/go-jose@v4.1.0...v4.1.1
v4.1.0Compare Source
What's Changed
signatureAlgorithmsargument by @tgeoghegan in #163New Contributors
Full Changelog: go-jose/go-jose@v4.0.5...v4.1.0
v4.0.5Compare Source
What's Changed
Fixes GHSA-c6gw-w398-hv78
Various other dependency updates, small fixes, and documentation updates in the full changelog
New Contributors
Full Changelog: go-jose/go-jose@v4.0.4...v4.0.5
v4.0.4: Version 4.0.4Compare Source
Fixed
v4.0.3: Version 4.0.3Compare Source
Changed
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.