Go Jose is a cryptographic library for the Go programming language that implements JSON Web Signature and JSON Web Encryption standards, deployed across applications requiring token handling and authentication. Despite its narrow product scope, the library sits in security-sensitive code paths where implementations often handle sensitive credentials and keys, making its reliability critical to downstream systems that depend on it. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Go Jose Project over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-34986HIGH Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS) | Apr 6, 2026 | 7.5 | 35 | NO | NO |
CVE-2016-9121CRITICAL go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check t | Mar 28, 2017 | 9.1 | 23 | NO | NO |
CVE-2016-9123HIGH go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on | Mar 28, 2017 | 7.5 | 20 | NO | NO |
CVE-2016-9122HIGH go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the AP | Mar 28, 2017 | 7.5 | 20 | NO | NO |
CVE-2024-28180MEDIUM Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used l | Mar 9, 2024 | 4.3 | 17 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Go Jose Project.
Media articles that mention a CVE ID that affects a product developed by Go Jose Project — matched by CVE ID, not by vendor name.