CVE-2016-9123: Go-Jose Project Go-Jose

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.

Affected products

• Go-Jose Project Go-Jose: up to and including 1.0.4

Published 2017-03-28. Last modified 2026-06-17.