Quick answers
- Is CVE-2026-116586 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116586 being exploited in the wild.
- How severe is CVE-2026-116586?
- Medium severity, with a CVSS score of 4, published 26 October 2026.
- Which products and versions are affected?
- github.com/go-jose/go-jose/v3 (Go) <= 3.0.5, SEMVER:introduced=0,last_affected=3.0.5; github.com/go-jose/go-jose/v4 (Go) < 4.1.5, SEMVER:introduced=0,fixed=4.1.5; Go-Jose before 4.1.5.
- Is there a fix for CVE-2026-116586?
- Yes. github.com/go-jose/go-jose/v4 (Go): upgrade to 4.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116586 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116586?
- Check whether you run github.com/go-jose/go-jose/v3 (Go), github.com/go-jose/go-jose/v4 (Go) or Go-Jose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- github.com/go-jose/go-jose/v4 (Go): upgrade to 4.1.5 or later
go get github.com/go-jose/go-jose/v4@v4.1.5
Technical details
A stack overflow vulnerability exists in go-jose's JSON parser prior to version 4.1.5, where deeply nested JSON arrays or objects can exceed Go's stack limit during parsing. The vulnerability occurs in the json/scanner.go component when parsing attacker-controlled input. The fix implements a maximum nesting depth limit of 10000 levels to prevent stack exhaustion.
Affected products
- go-jose go-jose before 4.1.5
Identifiers
- CVE-2026-116586
- GHSA-vvm8-gf78-28g4
Timeline
- 2026-10-26: disclosed
- 2026-09-03: patched