CVE-2026-116586
CVE
Medium
· CVSS 6.9
Medium Impactauth/validator: Go JOSE Crash via Deeply Nested JSON in Token Parsing
Exploitable under specific conditions
This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
Reachable on any endpoint protected by
auth/validator, because KrakenD parses the JSON
header of every incoming token before verifying its signature. An unauthenticated
client does not need a valid token to reach the vulnerable code. Endpoints without
auth/validator are not exposed.Component
auth/validator
Disclosed
Nov 2, 2026
CVSS Score
6.9
Description
Go JOSE parses the JSON of JWS and JWE objects with a recursive decoder that has no
nesting limit. Parsing a deeply nested JSON structure can exhaust the goroutine stack,
and Go treats a stack overflow as a fatal error that no
recover can catch, so the
whole process crashes rather than the single request. Affects go-jose v4 before 4.1.5
and all v3 versions. Fixed in go-jose 4.1.5.Version summary
Community Edition
3.0.3
addresses this advisory
Affected CE versions
>= 2.0, < 3.0.3
Enterprise Edition
3.0.3, 2.13.13
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.13 || >= 3.0, < 3.0.3
Upgrade to the addressed version or later to remediate this vulnerability.