Executive brief
DoS in go-jose Parsing in github.com/go-jose/go-jose
Affected products
- Go github.com/square/go-jose
- Go github.com/go-jose/go-jose/v4
- Go github.com/go-jose/go-jose/v3
- Go github.com/go-jose/go-jose
Junglewise Threat Intelligence
CVE-2025-27144: GO-2025-3485 - DoS in go-jose Parsing in github.com/go-jose/go-jose
CVE-2025-27144 · Severity: medium · CVSS 4 · Published 2025-03-03
Technologies: github.com/square/go-jose (Go), github.com/go-jose/go-jose/v4 (Go), github.com/go-jose/go-jose/v3 (Go). Vendors: Go.
Related threats
- Go JOSE denial of service via panic in JWE decryption
- GO-2024-2631 - Decompression bomb vulnerability in github.com/go-jose/go-jose
- Decryption of malicious PBES2 JWE objects can consume unbounded system resources
- GO-2023-2334 - Denial of service via decryption of malicious PBES2 JWE objects in github.com/go-jose/go-jose/v3
- Square go-jose integer overflow in CBC-HMAC decryption