Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/dvsekhvalnov/jose2go

2 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
v1.11.0 (Sep 8, 2026): no advisory affects it
Newest unaffected release
v1.11.0 (Sep 8, 2026), the latest release
Advisories
2 · 1 high
Releases
6 since v1.5.0 (Oct 1, 2020)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON…

    Affected: fixed in 1.7.0.

    Fixed in v1.7.0 (released Apr 19, 2024, 572 days before disclosure).

    The latest release, v1.11.0, is not affected.

  • The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2…

    Affected: fixed in 1.5.1-0.20231206184617-48ba0b76bc88; fixed in 1.6.0.

    Fixed in v1.6.0 (released Dec 6, 2023, 19 days before disclosure).

    The latest release, v1.11.0, is not affected.