A critical denial of service vulnerability exists in the Go JOSE library, where improper handling of JWE objects can lead to application crashes when processing specific key wrapping algorithms.

This is an uncaught exception (CWE-248) vulnerability triggered when an unauthenticated attacker provides a JSON Web Encryption (JWE) object with an empty encrypted_key field. The panic occurs during the key unwrapping process in the underlying cipher implementation, effectively crashing the host application.

The exploitation of this vulnerability leads to an immediate denial of service for any application utilizing the affected versions of the go-jose library. Given the CVSS score of 7.5, the impact is considered High due to the ease of exploitation over a network without requiring authentication. Organizations relying on this library for JWT or JWE processing face significant operational risk if their services are disrupted by malformed cryptographic inputs.

Immediate Action: Update the go-jose library to version 4.1.4 or 3.0.5 immediately to incorporate the necessary input validation checks.

Proactive Monitoring: Monitor application logs for frequent panics or unexpected service restarts specifically occurring during the parsing of cryptographic tokens.

Compensating Controls: If immediate patching is not feasible, ensure that the application configuration restricts accepted key algorithms, as the vulnerability is only reachable if the application permits key wrapping algorithms.

Public Exploit Available: Unknown.

The vulnerability presents a clear risk to service availability and should be prioritized for remediation. Developers must verify their dependencies and update to the fixed versions 4.1.4 or 3.0.5 to prevent potential denial of service attacks. Failure to patch may leave mission critical services exposed to remote, unauthenticated crashes.