Hi,

The following vulnerability was published for golang-github-go-jose-go-jose.v3.

CVE-2026-34986[0]:
| Go JOSE provides an implementation of the Javascript Object Signing
| and Encryption set of standards in Go, including support for JSON
| Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token
| (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web
| Encryption (JWE) object will panic if the alg field indicates a key
| wrapping algorithm (one ending in KW, with the exception of
| A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is
| empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go
| attempts to allocate a slice with a zero or negative length based on
| the length of the encrypted_key. This code path is reachable from
| ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact()
| followed by Decrypt() on the resulting object. Note that the parse
| functions take a list of accepted key algorithms. If the accepted
| key algorithms do not include any key wrapping algorithms, parsing
| will fail and the application will be unaffected. This panic is also
| reachable by calling cipher.KeyUnwrap() directly with any ciphertext
| parameter less than 16 bytes long, but calling this function
| directly is less common. Panics can lead to denial of service. This
| vulnerability is fixed in 4.1.4 and 3.0.5.

https://github.com/go-jose/go-jose/commit/0e59876635f3dbf46d7b5e97b52bb75a3f96e7d9 (v4.1.4)
https://github.com/go-jose/go-jose/commit/02464163e1e891db85257cb8860978a1c0226016 (v3.0.5)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-34986
https://www.cve.org/CVERecord?id=CVE-2026-34986

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
golang-github-go-jose-go-jose.v3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1136026@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated golang-github-go-jose-go-jose.v3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 03 Oct 2026 10:33:17 -0400
Source: golang-github-go-jose-go-jose.v3
Architecture: source
Version: 3.0.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 1136026
Changes:
 golang-github-go-jose-go-jose.v3 (3.0.5-1) unstable; urgency=medium
 .
   * New upstream release.
     - Fixes denial-of-service panic on empty JWE encrypted keys
       (CVE-2026-34986, Closes: #1136026)
   * debian: switch to standard Salsa CI pipeline
   * debian/patches: add DEP-3 metadata to remove-TestOpaqueKeyRoundtripJWE.patch
   * Declare compliance with Debian Policy 4.7.4
   * debian/control: upgrade to debhelper-compat (= 14)
   * debian/watch: upgrade to version 5 format
Checksums-Sha1:
 12accccb219f33a1673d7b369eeff8d68c77f212 2659 golang-github-go-jose-go-jose.v3_3.0.5-1.dsc
 9c2b71ee66ab7e2b39f38e81eb581f62af21a5eb 322281 golang-github-go-jose-go-jose.v3_3.0.5.orig.tar.gz
 45d5521972a857aefd797127c3c03912eb645d56 5456 golang-github-go-jose-go-jose.v3_3.0.5-1.debian.tar.xz
Checksums-Sha256:
 7205e0d3948df8166342eae039782c8cfd062bb9cea8a355655477a492cb60d5 2659 golang-github-go-jose-go-jose.v3_3.0.5-1.dsc
 72bed50c88a0d4a7db2fac07ec8f05fc74217a9a4d7588dec6b39d98d94c7c35 322281 golang-github-go-jose-go-jose.v3_3.0.5.orig.tar.gz
 eeffd0265f789e9117b88d189d02a6c3b7f4dc3c2caa3147915b413a6c6db6bc 5456 golang-github-go-jose-go-jose.v3_3.0.5-1.debian.tar.xz
Files:
 045dc80facd66276714c6a760ad77f8e 2659 golang optional golang-github-go-jose-go-jose.v3_3.0.5-1.dsc
 71851c7c76284083653001619e5621d5 322281 golang optional golang-github-go-jose-go-jose.v3_3.0.5.orig.tar.gz
 7e361ca54fa9c35d4f958fdd34d1e4b8 5456 golang optional golang-github-go-jose-go-jose.v3_3.0.5-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmrBHYwUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJstARRAAhJT+C7nR7IiGifFalIXxSzcQFRei
4wlWo45qxa5ED5uXKikpNmxmsykR1j2XRzSSRtBYuv4ZUlzNfn2CHg6RSn89FXAH
2rUdwts0xuTYaULV8bAMOtHuvFTbqWDgYXYftyP3/qoUjll5ZgmBVN0cOFULd/zz
VMrJj7cPFd6oURDEehT9acflQ41CpcqlyE0Kwpvlx6LtSVLgs/ij8U62MGTy7n6D
ZXtZp81gep3alXpLM2MVrr2BGZnDDvPGH91GMsMUrg8G2WENSxM5HmU5KPNu0ivC
gHqQ1wKvct3amXA0X5lIrYT0w4r5PHgV+YUH8+9kLq/KIkOVzvRzuqxZiRi4SqIW
LaLIKY8PYTIRI8sPva+HE+RqfA8oonNe0oEy1kgCdbWbzy+wbcUgPvIVCkJ/4tbT
ZIiyZFi7/cOc697dr7KT+i8CVuaHs2QfxqQ4rUHQmgee9PgjCwCvbwdnRdJiSxx1
7vW00GvoOgTBMnLbqWSDx81wwSWsCPCipYkD1gX5RQY/eAtJfJwmiqi+tYJO1MDI
c794eieZWh3GU3XoJcUwj7Y8WfJKBPBvSd+0NNlOKVPn61r1rRWldMQGB7xSr3GN
6P1QaJTy+gPlZVWNnw2YEUBeoVEJb1V9QfpN1iy+EVv5vpNDx1GB4s/sn0BsB6CG
0oxJrv86VcLn+ec=
=jmsG
-----END PGP SIGNATURE-----