Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-116587
By Roy Kalfon |
27 October 2026
CVE-2026-116587 – go-jose JWK RSA parsing triggers cubic-time `rsa.PrivateKey.Validate` DoS
DoS in go-jose/go-jose < 4.1.6: when parsing attacker-supplied JWKs with RSA keys, the library accepts unbounded/degenerate modulus/prime values and passes them to crypto/rsa.PrivateKey.Validate. On Go 1.24+, crafted parameters can force cubic CPU usage, causing remote availability loss in apps that parse untrusted JWKs. Upgrade to 4.1.6 to mitigate.