CVE-2016-9123: go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures.

Security readout for executives and security teams

CVE-2016-9123 affects older go-jose versions before 1.0.5. On 32-bit systems, a CBC-HMAC integer overflow could let encrypted messages pass authentication incorrectly. Business risk is concentrated in services that still run old Go JOSE code and accept CBC-HMAC encrypted ciphertexts. Exposure is most likely in legacy Go services using go-jose before 1.0.5, deployed on 32-bit architectures, and processing CBC-HMAC encrypted JOSE/JWE content. 64-bit-only deployments or deployments not using CBC-HMAC encrypted ciphertexts are not shown as affected by the provided sources. Treat this as a targeted legacy dependency risk, not a broad emergency. Prioritize teams running old Go services, embedded systems, or 32-bit environments. If those conditions exist, remediation should be scheduled promptly because the stated impact is authentication bypass. Mitigation focus: Upgrade go-jose to version 1.0.5 or later where it is used.; Inventory services using Go JOSE before 1.0.5.; Prioritize review of 32-bit builds and deployments..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.