CVE-2026-34986

OVERVIEW CVE-2026-34986 is a denial-of-service vulnerability in Go JOSE, a Go implementation of the Javascript Object Signing and Encryption (JOSE) standards. The flaw exists in versions prior to 4.1.4 and 3.0.5 and is triggered when decrypting a JSON Web Encryption (JWE) object with a key wrapping algorithm specified in the alg field and an empty encrypted_key field. The vulnerability causes the application to panic during the key unwrapping process when the cipher.KeyUnwrap() function attempts to allocate memory with an invalid length. This vulnerability is reachable through the normal parsing and decryption workflow, making it a practical attack vector for applications using Go JOSE with key wrapping algorithms enabled. SEVERITY The vulnerability carries a CVSS score of 7.5 (High) with a network-based attack vector requiring no authentication, special privileges, or user interaction. The attack has low complexity and results in high availability impact through denial of service. While the vulnerability does not compromise confidentiality or integrity, the ability to remotely trigger an application crash without authentication presents significant operational risk. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with the vulnerability not appearing on any public exploit or known exploited vulnerabilities list. The EPSS score of 0.00019 indicates minimal probability of exploitation compared to other CVEs. Community attention appears limited, though the issue is straightforward to understand and exploit, requiring only a malformed JWE message sent to a vulnerable application.