CVE-2016-9122: go-jose before 1.0.4 suffers from multiple signatures exploitation.

Security readout for executives and security teams

Older go-jose versions could let an application validate one signature but accidentally trust header data from another attached signature. This is mainly a library integration risk: impact depends on whether the application uses those headers for security decisions such as identity, key selection, or authorization. Exposure is likely limited to Go applications using go-jose before 1.0.4 that accept multi-signature JOSE/JWS messages and use protected header values after validation. Single-signature-only usage or code that ignores signature headers is less exposed. Treat this as a targeted dependency remediation item, not an internet-wide emergency. Prioritize systems using old go-jose for authentication, tokens, identity assertions, or signed authorization data. Mitigation focus: Upgrade go-jose to version 1.0.4 or later.; Review all services that parse JOSE/JWS messages with go-jose.; Check vendor and project guidance before applying compensating controls..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.