{"action":"Upgrade github.com/dvsekhvalnov/jose2go to 1.5.1-0.20231206184617-48ba0b76bc88 or later.","affected":[{"fixed":"1.5.1-0.20231206184617-48ba0b76bc88","introduced":"0"}],"component":"github.com/dvsekhvalnov/jose2go","cve_ids":["CVE-2023-50658"],"ecosystem":"Go","epss":0.00824,"exploited":false,"fixed_versions":["1.5.1-0.20231206184617-48ba0b76bc88"],"ghsa_id":"GHSA-6294-6rgp-fr7r","id":"tcs_01M5KG0TW28VAVAHQB9248PBGR","modified_at":"2026-02-04T03:28:14.460734Z","published_at":"2023-12-20T17:35:00Z","references":["https://osv.dev/vulnerability/GO-2023-2409","https://github.com/dvsekhvalnov/jose2go/issues/31","https://www.blackhat.com/us-23/briefings/schedule/#three-new-attacks-against-json-web-tokens-31695","https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2023-2409","url":"https://osv.dev/vulnerability/GO-2023-2409"}],"summary":"Denial of service when decrypting attacker controlled input in github.com/dvsekhvalnov/jose2go"}