CVE-2026-116585
CVE
Medium
· CVSS 6.9
False Positiveauth/validator: Go JOSE Panic During CBC-HMAC Decryption of JWE Tokens
This advisory does not affect KrakenD
KrakenD’s
auth/validator component does not implement JWE (JSON Web Encryption)
support. It only parses and verifies signed tokens (JWS), so the CBC-HMAC decryption
path of the underlying library is never invoked. The library was upgraded as a
precaution.Addressed through routine dependency maintenance in CE 3.0.3 and EE 3.0.3, 2.13.13.
Component
auth/validator
Disclosed
Nov 2, 2026
CVSS Score
6.9
Description
Go JOSE does not validate the parameters of a JWE that uses the
A128CBC-HS256,
A192CBC-HS384 or A256CBC-HS512 content encryption algorithms, and indexes into an
empty buffer while decrypting it. Any application that calls ParseEncrypted,
ParseEncryptedJSON or ParseEncryptedCompact and decrypts untrusted ciphertexts with
these algorithms panics. Affects go-jose v4 before 4.1.5 and all v3 versions.