GHSA-vvm8-gf78-28g4 - Go JOSE: Panics in JSON parsing
### Summary
Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.
Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.
### Impact
Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.
### Workarounds
Reject large inputs before parsing them.
### Acknowledgements
Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.
HIGH
Severity & confidence
Source severitymedium
Platform severityhigh
Confidenceconfirmed
Exploitationunknown
CVSS-
Affected
VendorsgithubRed Hat
Productsgithub.com/go-jose/go-jose/v4github.com/go-jose/go-jose/v3
Reporting sources (3)
GitHub Security Advisories
Red Hat - CVE Feed
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-28T21:14:08
Last updated2026-10-30T22:59:15
Ingested2026-10-28T21:27:23
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
This object is reported by 3 independent sources.
Source type: vendor ยท Original: GitHub Security Advisories
