GoJOSE JWE Decrypt Panic (DoS) Fixed v4.1.4/3.0.5
CVE-2026-34986 Published on April 6, 2026

Go JOSE affect by a panic in JWE decryption
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.

NVD

Vulnerability Analysis

CVE-2026-34986 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Types

Uncaught Exception

An exception is thrown from a function, but it is not caught. When an exception is not caught, it may cause the program to crash or expose sensitive information.

Incorrect Calculation of Buffer Size

The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.


Products Associated with CVE-2026-34986

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Cryostat
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel E4s
 
Red Hat Rhel Eus
 
Red Hat Openshift Custom Metrics Autoscaler
 
Red Hat Logging
 
Red Hat Multicluster Globalhub
 
Red Hat Openshift Api Data Protection
 
Red Hat Acm
 
Red Hat Advanced Cluster Security
 
Red Hat Openshift Ai
 
Red Hat Openshift
 
Red Hat Openshift Devspaces
 
Red Hat Openshift Gitops
 
Red Hat Openshift Pipelines
 
Red Hat Service Mesh
 
Red Hat Openshift Distributed Tracing
 
Red Hat Openshift Data Foundation
 
Red Hat Quay
 
Red Hat Trusted Artifact Signer
 
Red Hat Multicluster Engine
 
Red Hat Assisted Installer
 
Red Hat Cert Manager
 
Red Hat Confidential Compute Attestation
 
Red Hat Kernel Module Management
 
Red Hat Rhmt
 
Red Hat Migration Toolkit Virtualization
 
Red Hat Ocp Tools
 
Red Hat Openshift Lightspeed
 
Red Hat Serverless
 
Red Hat Ansible Automation Platform
 
Red Hat Podman Desktop
 
Red Hat Connectivity Link
 
Red Hat Openshift Cluster Manager Cli
 
Red Hat Openshift Service On Aws
 
Red Hat Openshift Security Profiles Operator
 
Red Hat Zero Trust Workload Identity Manager
 
Red Hat External Secrets Operator
 
Red Hat Lvms
 
Red Hat Network Observ Optr
 
Red Hat Workload Availability Nhc
 
Red Hat Openshift Power Monitoring
 
Red Hat Kueue Operator
 
Red Hat Windows Machine Config
 
Red Hat Container Native Virtualization
 
Red Hat Openstack
 

Affected Versions

go-jose: Red Hat Cryostat 4 on RHEL 9: Red Hat Enterprise Linux AppStream EUS (v. 10.0): Red Hat Enterprise Linux AppStream (v. 10): Red Hat Enterprise Linux AppStream (v. 8): Red Hat Enterprise Linux AppStream E4S (v.9.2): Red Hat Enterprise Linux AppStream E4S (v.9.4): Red Hat Enterprise Linux AppStream EUS (v.9.4): Red Hat Enterprise Linux AppStream EUS (v.9.6): Red Hat Enterprise Linux AppStream (v. 9): Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0): Red Hat Enterprise Linux CodeReady Linux Builder (v. 10): Red Hat Custom Metric Autoscaler 2.19: Logging Subsystem for Red Hat OpenShift 6.0: Logging Subsystem for Red Hat OpenShift 6.4: Red Hat Multicluster Global Hub 1.3.4: Red Hat Multicluster Global Hub 1.4.5: Red Hat Multicluster Global Hub 1.5.4: Red Hat Multicluster Global Hub 1.6.2: Red Hat OpenShift API for Data Protection 1.4: Red Hat OpenShift API for Data Protection 1.5: Red Hat Advanced Cluster Management for Kubernetes 2.14: Red Hat Advanced Cluster Security for Kubernetes 4.10: Red Hat Advanced Cluster Security for Kubernetes 4.8: Red Hat Advanced Cluster Security for Kubernetes 4.9: Red Hat OpenShift AI 2.25: Red Hat OpenShift AI 3.3: Red Hat OpenShift Container Platform 4.17: Red Hat OpenShift Container Platform 4.18: Red Hat OpenShift Container Platform 4.19: Red Hat OpenShift Container Platform 4.20: Red Hat OpenShift Container Platform 4.21: Red Hat OpenShift Container Platform 4.22: Red Hat OpenShift Dev Spaces 3.27: Red Hat OpenShift GitOps 1.18: Red Hat OpenShift Pipelines 1.21: Red Hat OpenShift Pipelines 1.2: Red Hat OpenShift Service Mesh 2.6: Red Hat OpenShift Service Mesh 3.1: Red Hat OpenShift Service Mesh 3.2: Red Hat OpenShift Service Mesh 3.3: Red Hat OpenShift distributed tracing 3.9.3: Red Hat Openshift Data Foundation 4.17: Red Hat Openshift Data Foundation 4.18: Red Hat Openshift Data Foundation 4.19: Red Hat Openshift Data Foundation 4.2: Red Hat Quay 3.10: Red Hat Quay 3.12: Red Hat Quay 3.14: Red Hat Quay 3.15: Red Hat Quay 3.16: Red Hat Quay 3.17: Red Hat Quay 3.9: Red Hat Trusted Artifact Signer 1.3: Red Hat multicluster engine for Kubernetes 2.10: Red Hat multicluster engine for Kubernetes 2.11: Red Hat multicluster engine for Kubernetes 2.6: Red Hat multicluster engine for Kubernetes 2.7: Red Hat multicluster engine for Kubernetes 2.8: Red Hat multicluster engine for Kubernetes 2.9: Assisted Installer for Red Hat OpenShift Container Platform 2: cert-manager Operator for Red Hat OpenShift: Red Hat Confidential Compute Attestation: Kernel Module Management Operator for Red Hat Openshift: Logging Subsystem for Red Hat OpenShift: Red Hat Migration Toolkit for Containers: Red Hat Migration Toolkit for Virtualization: Red Hat Multicluster Engine for Kubernetes: Red Hat Multicluster Global Hub: Red Hat OpenShift Developer Tools and Services: Red Hat OpenShift Lightspeed: Red Hat OpenShift Pipelines: Red Hat OpenShift Serverless: Red Hat OpenShift Service Mesh 3: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Ansible Automation Platform 2: Red Hat Build of Podman Desktop: Red Hat Build of Podman Desktop - Tech Preview: Red Hat Connectivity Link 1: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Cluster Manager CLI: Red Hat OpenShift Container Platform 4: Red Hat Openshift Data Foundation 4: Red Hat OpenShift Dev Spaces: Red Hat OpenShift GitOps: Red Hat OpenShift on AWS: Red Hat Quay 3: Red Hat Trusted Artifact Signer: Red Hat Security Profiles Operator: Red Hat Zero Trust Workload Identity Manager - Tech Preview: External Secrets Operator for Red Hat OpenShift: Red Hat Logical Volume Manager Storage: Red Hat Network Observability Operator: Red Hat Node HealthCheck Operator: Red Hat OpenShift Service Mesh 2: Power monitoring for Red Hat OpenShift: Red Hat Advanced Cluster Security 4: Red Hat Build of Kueue: Red Hat OpenShift for Windows Containers: Red Hat OpenShift Virtualization 4: Red Hat OpenStack Platform 18.0: Red Hat Zero Trust Workload Identity Manager:

Exploit Probability

EPSS
0.27%
Percentile
18.95%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.