{"schema_version":"1.7.5","id":"GO-2026-4945","published":"2026-05-26T22:49:18Z","modified":"2026-06-01T21:14:16.019255008Z","aliases":["CVE-2026-34986","GHSA-78h2-9frx-2jm8"],"related":["CGA-rq7r-7wq9-h37h"],"summary":"Go JOSE Panics in JWE decryption in github.com/go-jose/go-jose","details":"The go-jose package is subject to a panic when decrypting certain JSON Web Encryption (JWE) tokens. This occurs when an attacker can provide a maliciously crafted JWE token that triggers an unhandled exception during the decryption process, leading to a denial-of-service.","affected":[{"package":{"name":"github.com/go-jose/go-jose/v3","ecosystem":"Go","purl":"pkg:golang/github.com/go-jose/go-jose/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.5"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/go-jose/go-jose/v3"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4945.json"}},{"package":{"name":"github.com/go-jose/go-jose/v4","ecosystem":"Go","purl":"pkg:golang/github.com/go-jose/go-jose/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.4"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/go-jose/go-jose/v4"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4945.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"},{"type":"WEB","url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-4945"},"credits":[{"name":"Datadog's Security team"}]}