Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/square/go-jose

3 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 medium
Registry
pkg.go.dev

Advisories 3

  • CVE-2025-27144Medium 6.6

    Go JOSE's Parsing Vulnerable to Denial of Service

    Affected: all versions.

  • go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures.

    Affected: fixed in 0.0.0-20160903044734-789a4c4bd4c1.

  • go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm.

    Affected: fixed in 1.0.4.