CVE-2026-116586
Description
A flaw was found in go-jose. A remote attacker could cause a Denial of Service (DoS) by submitting specially crafted, deeply nested JSON (JavaScript Object Notation) input to an affected application. When parsing these deeply nested arrays or objects, the system exceeds its stack memory limits, triggering an application crash.
Statement
This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger a denial of service against services that process JOSE structures, causing affected components to crash without recovery. In Red Hat environments such as OpenShift and Advanced Cluster Management, go-jose is integrated into core control plane proxies and management services that inspect incoming tokens. While the issue does not lead to confidentiality or integrity loss or code execution, terminating these daemons interrupts critical cluster authentication and administrative operations.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce nesting depth limits and input size bounds on incoming JSON payloads before parsing them with go-jose: upgrade to go-jose 4.1.5 (or the corresponding fixed Red Hat builds), which enforce a maximum JSON nesting depth limit of 10,000 in pushParseState and return an error when exceeded, closing all 2 injection vectors (deeply nested JSON arrays, deeply nested JSON objects). Until patched, this is a concern on Applications and services parsing untrusted JSON or JOSE tokens with go-jose, so Reject large inputs before parsing and restrict unauthenticated network access to endpoints handling untrusted JOSE tokens. As a compensating measure, Configure systemd service watchdogs and automatic restart settings to recover daemons following fatal stack overflow crashes. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded recursion stack overflow defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
