GHSA-mgcc-cww5-fp2q

Go JOSE: DoS when parsing JWKs that contain RSA keys

High highest severity reported · also known as CVE-2026-116587

19
catalog tools match this advisory
0
ship the vulnerable code in their release binary (Go tools analyzed with govulncheck)
No
in the CISA KEV catalog
0.4%
EPSS for CVE-2026-116587, percentile 30

Catalog tools matching GHSA-mgcc-cww5-fp2q

ToolVersion scannedPackageFixed inReleased binaryDeclared in or found inDispute
grype
Software Composition Analysis (SCA)
v0.121.0github.com/go-jose/go-jose/v4@v4.1.5
golang
4.1.6vulnerable code not in binarygo.modDispute
syft
SBOM Generation
v1.55.0github.com/go-jose/go-jose/v4@v4.1.5
golang
4.1.6vulnerable code not in binarygo.modDispute
trivy
Software Composition Analysis (SCA)
v0.76.1github.com/go-jose/go-jose/v4@v4.1.5
golang
4.1.6vulnerable code not in binarygo.modDispute
kics
Infrastructure as Code Security
v2.2.0github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6not analyzedgo.modDispute
cloudquery
Cloud Security
cli-v6.49.2github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6not in released binaryplugins/destination/gcs/go.modDispute
sops
Secret Management
v3.13.3github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarygo.modDispute
vault
Secret Management
v2.2.1github.com/go-jose/go-jose/v3@v3.0.5
golang
no fix listednot analyzedgo.modDispute
vault
Secret Management
v2.2.1github.com/go-jose/go-jose/v4@v4.1.5
golang
4.1.6not analyzedapi/auth/azure/go.modDispute
kubescape
Kubernetes Security
v4.0.17github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarygo.modDispute
kyverno
Kubernetes Security
v1.19.2github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarygo.modDispute
conftest
Policy as Code
v0.71.1github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarygo.modDispute
scorecard
Supply Chain Compliance
v5.6.0github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarytools/go.modDispute
nuclei
API & Dynamic Testing (DAST)
v3.11.1github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarygo.modDispute
clair
Container Security › Image Scanning
v4.9.0github.com/go-jose/go-jose/v3@v3.0.4
golang
no fix listedvulnerable code not in binarygo.modDispute
vet
Software Composition Analysis (SCA)
v1.20.0github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarygo.modDispute
rekor
Artifact Signing & Verification
v1.5.5github.com/go-jose/go-jose/v4@v4.1.5
golang
4.1.6vulnerable code not in binarygo.modDispute
slsa-verifier
Supply Chain Compliance
v2.7.1github.com/go-jose/go-jose/v4@v4.0.5
golang
4.1.6vulnerable code not in binarygo.modDispute
snyk-cli
Software Composition Analysis (SCA)
v1.1308.3github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6vulnerable code not in binarycliv2-private/go.modDispute
kube-linter
Kubernetes Security
v0.8.3github.com/go-jose/go-jose/v4@v4.1.3
golang
4.1.6not in released binarytool-imports/go.modDispute
trufflehog
Pre-commit & Secrets Detection
v3.99.7github.com/go-jose/go-jose/v4@v4.1.4
golang
4.1.6not analyzedgo.modDispute

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Released binary is only analyzed for Go tools with a Linux release binary; other tools show not analyzed.

Advisory sources

GitHub advisory GHSA-mgcc-cww5-fp2q · NVD CVE-2026-116587 · OSV GHSA-mgcc-cww5-fp2q

Grype data sources: https://github.com/advisories/GHSA-mgcc-cww5-fp2q