CVE-2026-116587

Name of the Vulnerable Software and Affected Versions go-jose versions prior to 4.1.6

Description The software parses attacker-controlled RSA modulus and prime values from JSON Web Keys (JWKs) without enforcing size and consistency bounds before passing them to the crypto/rsa.PrivateKey.Validate function. On Go 1.24 and later, specifically crafted large or degenerate RSA parameters can cause the validation process to consume cubic CPU time, leading to a remote denial of service in applications that process JWKs from untrusted sources.

Recommendations Update to version 4.1.6.