Your message dated Sat, 03 Oct 2026 15:34:10 +0000
with message-id <[email protected]>
and subject line Bug#1136026: fixed in golang-github-go-jose-go-jose.v3 3.0.5-1
has caused the Debian Bug report #1136026,
regarding golang-github-go-jose-go-jose.v3: CVE-2026-34986
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1136026: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136026
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: golang-github-go-jose-go-jose.v3
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for golang-github-go-jose-go-jose.v3.
CVE-2026-34986[0]:
| Go JOSE provides an implementation of the Javascript Object Signing
| and Encryption set of standards in Go, including support for JSON
| Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token
| (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web
| Encryption (JWE) object will panic if the alg field indicates a key
| wrapping algorithm (one ending in KW, with the exception of
| A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is
| empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go
| attempts to allocate a slice with a zero or negative length based on
| the length of the encrypted_key. This code path is reachable from
| ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact()
| followed by Decrypt() on the resulting object. Note that the parse
| functions take a list of accepted key algorithms. If the accepted
| key algorithms do not include any key wrapping algorithms, parsing
| will fail and the application will be unaffected. This panic is also
| reachable by calling cipher.KeyUnwrap() directly with any ciphertext
| parameter less than 16 bytes long, but calling this function
| directly is less common. Panics can lead to denial of service. This
| vulnerability is fixed in 4.1.4 and 3.0.5.
https://github.com/go-jose/go-jose/commit/0e59876635f3dbf46d7b5e97b52bb75a3f96e7d9
(v4.1.4)
https://github.com/go-jose/go-jose/commit/02464163e1e891db85257cb8860978a1c0226016
(v3.0.5)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-34986
https://www.cve.org/CVERecord?id=CVE-2026-34986
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: golang-github-go-jose-go-jose.v3
Source-Version: 3.0.5-1
Done: Reinhard Tartler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
golang-github-go-jose-go-jose.v3, which is due to be installed in the Debian
FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Reinhard Tartler <[email protected]> (supplier of updated
golang-github-go-jose-go-jose.v3 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 03 Oct 2026 10:33:17 -0400
Source: golang-github-go-jose-go-jose.v3
Architecture: source
Version: 3.0.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Reinhard Tartler <[email protected]>
Closes: 1136026
Changes:
golang-github-go-jose-go-jose.v3 (3.0.5-1) unstable; urgency=medium
.
* New upstream release.
- Fixes denial-of-service panic on empty JWE encrypted keys
(CVE-2026-34986, Closes: #1136026)
* debian: switch to standard Salsa CI pipeline
* debian/patches: add DEP-3 metadata to
remove-TestOpaqueKeyRoundtripJWE.patch
* Declare compliance with Debian Policy 4.7.4
* debian/control: upgrade to debhelper-compat (= 14)
* debian/watch: upgrade to version 5 format
Checksums-Sha1:
12accccb219f33a1673d7b369eeff8d68c77f212 2659
golang-github-go-jose-go-jose.v3_3.0.5-1.dsc
9c2b71ee66ab7e2b39f38e81eb581f62af21a5eb 322281
golang-github-go-jose-go-jose.v3_3.0.5.orig.tar.gz
45d5521972a857aefd797127c3c03912eb645d56 5456
golang-github-go-jose-go-jose.v3_3.0.5-1.debian.tar.xz
Checksums-Sha256:
7205e0d3948df8166342eae039782c8cfd062bb9cea8a355655477a492cb60d5 2659
golang-github-go-jose-go-jose.v3_3.0.5-1.dsc
72bed50c88a0d4a7db2fac07ec8f05fc74217a9a4d7588dec6b39d98d94c7c35 322281
golang-github-go-jose-go-jose.v3_3.0.5.orig.tar.gz
eeffd0265f789e9117b88d189d02a6c3b7f4dc3c2caa3147915b413a6c6db6bc 5456
golang-github-go-jose-go-jose.v3_3.0.5-1.debian.tar.xz
Files:
045dc80facd66276714c6a760ad77f8e 2659 golang optional
golang-github-go-jose-go-jose.v3_3.0.5-1.dsc
71851c7c76284083653001619e5621d5 322281 golang optional
golang-github-go-jose-go-jose.v3_3.0.5.orig.tar.gz
7e361ca54fa9c35d4f958fdd34d1e4b8 5456 golang optional
golang-github-go-jose-go-jose.v3_3.0.5-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmrBHYwUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJstARRAAhJT+C7nR7IiGifFalIXxSzcQFRei
4wlWo45qxa5ED5uXKikpNmxmsykR1j2XRzSSRtBYuv4ZUlzNfn2CHg6RSn89FXAH
2rUdwts0xuTYaULV8bAMOtHuvFTbqWDgYXYftyP3/qoUjll5ZgmBVN0cOFULd/zz
VMrJj7cPFd6oURDEehT9acflQ41CpcqlyE0Kwpvlx6LtSVLgs/ij8U62MGTy7n6D
ZXtZp81gep3alXpLM2MVrr2BGZnDDvPGH91GMsMUrg8G2WENSxM5HmU5KPNu0ivC
gHqQ1wKvct3amXA0X5lIrYT0w4r5PHgV+YUH8+9kLq/KIkOVzvRzuqxZiRi4SqIW
LaLIKY8PYTIRI8sPva+HE+RqfA8oonNe0oEy1kgCdbWbzy+wbcUgPvIVCkJ/4tbT
ZIiyZFi7/cOc697dr7KT+i8CVuaHs2QfxqQ4rUHQmgee9PgjCwCvbwdnRdJiSxx1
7vW00GvoOgTBMnLbqWSDx81wwSWsCPCipYkD1gX5RQY/eAtJfJwmiqi+tYJO1MDI
c794eieZWh3GU3XoJcUwj7Y8WfJKBPBvSd+0NNlOKVPn61r1rRWldMQGB7xSr3GN
6P1QaJTy+gPlZVWNnw2YEUBeoVEJb1V9QfpN1iy+EVv5vpNDx1GB4s/sn0BsB6CG
0oxJrv86VcLn+ec=
=jmsG
-----END PGP SIGNATURE-----
pgpKKiKOzeAhD.pgp
Description: PGP signature
--- End Message ---
