CVE-2016-9123: Integer Overflow in go-jose

June 23, 2021 (updated July 6, 2026)

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.

References

github.com/advisories/GHSA-3fx4-7f69-5mmg
github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96
hackerone.com/reports/165170
nvd.nist.gov/vuln/detail/CVE-2016-9123
pkg.go.dev/vuln/GO-2020-0009
www.openwall.com/lists/oss-security/2016/11/03/1

Code Behaviors & Features

Detect and mitigate CVE-2016-9123 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →