CVE-2026-116586

About vulnerability

Summary

Parsing deeply nested JSON structures can hit Go’s stack limit, causing the application to crash.

Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4.

Impact

Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.

Workarounds

Reject large inputs before parsing them.

Acknowledgements

Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.

Affected product:

GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric , Grafana , Loki , MinIO , argocd , containerd/containerd , containerd/imgcrypt , containers/ocicrypt , coreos/go-oidc , etcd-io/etcd/api , etcd-io/etcd/client , go-jose/go-jose , google/s2a-go , googleapis/gax-go , googleapis/go-genproto , googleapis/go-genproto/googleapis/bytestream , googleapis/google-api-go-client , googleapis/google-cloud-go , googleapis/google-cloud-go/auth , googleapis/google-cloud-go/auth/oauth2adapt , googleapis/google-cloud-go/iam , googleapis/google-cloud-go/monitoring , googleapis/google-cloud-go/storage , grafana/authlib , grafana/dataplane/examples , grafana/dataplane/sdata , grafana/grafana-aws-sdk , grafana/grafana-azure-sdk-go , grafana/grafana-google-sdk-go , grafana/grafana-plugin-sdk-go , grafana/grafana/pkg/aggregator , grafana/grafana/pkg/apimachinery , grafana/grafana/pkg/apiserver , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/sqlds , grpc/grpc-go , hashicorp/consul , hashicorp/vault-plugin-auth-alicloud , hashicorp/vault/api , hashicorp/vault/api/auth/gcp , heroku/x , influxdata/telegraf , minio/colorjson , minio/pkg , open-telemetry/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc , prometheus/prom2json , prometheus/prometheus , spiffe/go-spiffe , testcontainers/testcontainers-go

Affected packages:

github.com/go-jose/go-jose @ 3.0.3 (+78 more)