GHSA-c6gw-w398-hv78: github.com/go-jose/go-jose fixed in 3.0.4

GHSA-c6gw-w398-hv78 PUBLISHED CVSS 6.900000095367432 MEDIUM

DoS in go-jose Parsing

Record from GitHub Advisory Database · Published February 24, 2025

github.com/go-jose/go-jose is fixed in 3.0.4 (Go Modules)

DoS in go-jose Parsing

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/go-jose/go-jose	Go Modules	3.0.4
github.com/go-jose/go-jose/v4	Go Modules	4.0.5
harbor-2.10	Chainguard	2.10.3-r9
harbor-2.11	Chainguard	2.11.2-r4
dagdotdev	Chainguard	0.0.13-r1
cert-manager-1.17	Wolfi	1.17.1-r1
spire-controller-manager	Wolfi	0.6.1-r1
nerdctl	Wolfi	2.0.3-r2
istio-operator-1.22	Chainguard	1.22.8-r2
consul-fips-1.18	Chainguard	1.18.2-r6
chainctl	Chainguard	0.2.59-r0
istio-fips-1.24	Chainguard	1.24.3-r2

88 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0

6.900000095367432

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected products

Vendor	Product	Versions
chainguard	harbor-2.10	0
chainguard	harbor-2.11	0
chainguard	dagdotdev	0
wolfi	cert-manager-1.17	0
wolfi	spire-controller-manager	0
wolfi	nerdctl	0
chainguard	istio-operator-1.22	0
chainguard	consul-fips-1.18	0
chainguard	chainctl	0
chainguard	istio-fips-1.24	0
chainguard	cert-manager-1.17	0
wolfi	cilium-1.16	0
wolfi	kyverno-notation-aws	0
chainguard	istio-cni-1.22	0
wolfi	argo-cd-2.11	0
chainguard	step	0
wolfi	gatus	0
chainguard	kyverno-notation-aws-fips	0
chainguard	traefik-fips-3.2	0
chainguard	bank-vaults	0

…and 396 more

Timeline

Feb 24, 2025 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-c6gw-w398-hv78
vulnetix vdb fixes GHSA-c6gw-w398-hv78

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-c6gw-w398-hv78/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →