CVE-2026-116587
Description
A flaw was found in go-jose. A remote attacker can cause a Denial of Service (DoS) by supplying a crafted JSON Web Key (JWK) with oversized or degenerate RSA cryptographic parameters. Because the library fails to enforce size and consistency bounds prior to validation, processing these malicious keys consumes excessive CPU resources and can lead to an application hang or crash.
Statement
This vulnerability is rated as having an Important severity for Red Hat products because an unauthenticated remote attacker can trigger significant CPU resource exhaustion and service disruption by submitting untrusted JSON Web Keys to exposed endpoints. In environments running affected OpenShift and Kubernetes management components, processing these malformed cryptographic keys can saturate compute capacity and degrade critical control-plane services. The impact is limited to availability, as the issue does not allow data alteration or privilege escalation.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce size and consistency bounds on RSA modulus and prime parameters before passing JWK structures to crypto/rsa validation: upgrade to go-jose 4.1.6 (or the corresponding fixed Red Hat builds), which enforces a default 4096-bit limit on RSA modulus parsing, verifies prime products match the modulus, and rejects private key parameters embedded in JWK or EPK headers, closing all 3 injection vectors (crafted JWK with oversized RSA modulus, crafted JWK with degenerate RSA prime parameters, private key parameters embedded in JWK or EPK headers). Until patched, this is a concern on Applications compiled with Go 1.24 or later that parse untrusted JWK, JWE, JWS, or JWT payloads, so Restrict unauthenticated remote access to endpoints parsing untrusted JWK payloads and enforce ingress filtering on incoming cryptographic tokens. As a compensating measure, Impose process-level CPU execution limits via ulimit or prlimit to terminate runaway validation loops, Configure systemd WatchdogSec and automatic restart to recover from CPU starvation and hangs, Constrain process CPU allocation using cgroups v2 to limit the host blast radius of cubic-time computation, and Enforce rate limiting and connection throttling on exposed endpoints to restrict request volume. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded RSA parameter validation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
