Go-jose_project Go-jose
4 CVEs affecting Go-jose_project Go-jose. Latest disclosed: 2026-04-06. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9121 | Critical | 9.1 | 2017-03-28 | go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose… |
CVE-2026-34986 | High | 7.5 | 2026-04-06 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSO… |
CVE-2016-9123 | High | 7.5 | 2017-03-28 | go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC enc… |
CVE-2016-9122 | High | 7.5 | 2017-03-28 | go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a… |