GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: bump go-jose/v4 to v4.1.6 (backport 2.38) by coder[bot] · Pull Request #31440 · coder/coder

Conversation

@coder

@coder coder Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/go-jose/go-jose/v4 from v4.1.4 to v4.1.6 on release/2.38. That fixes CVE-2026-116587 / GHSA-mgcc-cww5-fp2q, a CPU denial of service through crafted RSA JWKs.

The IronBank VAT scan of coder-service-2:2.38.3 flags this (High) in /opt/coder. The code is reachable: coderd/jwtutils parses tokens with jose.ParseSigned/ParseEncrypted, and parsing validates any key embedded in the token's jwk header. Main is already on v4.1.6 (from #31288), so this only bumps the module, not the rest of that PR.

go mod tidy changed no other modules. Verified: go test ./coderd/jwtutils/... ./coderd/oauthpki/... passes. Local git hooks were skipped; CI is the gate.

Part of ENT-227 (parent ENT-230). The VAT justification commits to a fix by 2026-11-27, so this needs to ship in a 2.38 patch release.

Opened by Superblink on behalf of @droopy4096.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@linear-code

linear-code Bot commented Oct 28, 2026

Copy link
Copy Markdown

ENT-227
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot added the community Pull Requests and issues created by the community. label Oct 28, 2026
@coder coder Bot added the cherry-pick/v2.38 Cherry-pick PR targeting release/2.38 label Oct 28, 2026
@coder coder Bot assigned droopy4096 Oct 28, 2026
This was referenced Oct 28, 2026
fix: bump go-jose/v4 to v4.1.6 (backport 2.37) #31444
Merged
fix: bump go-jose/v4 to v4.1.6 (backport 2.36) #31447
Merged
fix: bump go-jose/v4 to v4.1.6 (backport 2.34) #31450
Merged
fix: bump go-jose/v4 to v4.1.6 (backport 2.29) #31454
Merged
@droopy4096
droopy4096 marked this pull request as ready for review October 28, 2026 22:17
@coder
coder Bot requested review from denisra, jdomeracki-coder and zenithwolf1000 October 29, 2026 17:20
denisra pushed a commit that referenced this pull request Nov 2, 2026
@coder
fix: bump go-jose/v4 to v4.1.6 (backport 2.29) (#31454)
5fd7dc1 
Backport of the go-jose bump to `release/2.29` (same change as #31440
for 2.38; main is already on v4.1.6). Bumps
`github.com/go-jose/go-jose/v4` from v4.1.4 to v4.1.6, fixing
CVE-2026-116587 /
[GHSA-mgcc-cww5-fp2q](GHSA-mgcc-cww5-fp2q)
(CPU DoS through crafted RSA JWKs). Flagged by the IronBank VAT scan of
2.38.3.

`go mod tidy` changed no other modules and left the `go` directive
alone. Verified: `go test ./coderd/jwtutils/...` passes. Local git hooks
were skipped; CI is the gate.

Part of [ENT-227](https://linear.app/codercom/issue/ENT-227) (parent
[ENT-230](https://linear.app/codercom/issue/ENT-230)). Backported to
every supported release line per the backport policy in CONTRIBUTING.md.

Opened by Superblink on behalf of @droopy4096.

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
@coder @denisra
fix: bump go-jose/v4 to v4.1.6 (backport 2.38)
43015c3 
Fixes CVE-2026-116587 / GHSA-mgcc-cww5-fp2q (CPU DoS via crafted RSA JWKs) in /opt/coder, flagged by the IronBank VAT scan of 2.38.3.

Refs ENT-227
@denisra
denisra force-pushed the superblink/ent-227-go-jose-416-release-238 branch from a8f1505 to 43015c3 Compare November 2, 2026 18:35
denisra pushed a commit that referenced this pull request Nov 2, 2026
@coder
fix: bump go-jose/v4 to v4.1.6 (backport 2.34) (#31450)
3c254da 
Backport of the go-jose bump to `release/2.34` (same change as #31440
for 2.38; main is already on v4.1.6). Bumps
`github.com/go-jose/go-jose/v4` from v4.1.4 to v4.1.6, fixing
CVE-2026-116587 /
[GHSA-mgcc-cww5-fp2q](GHSA-mgcc-cww5-fp2q)
(CPU DoS through crafted RSA JWKs). Flagged by the IronBank VAT scan of
2.38.3.

`go mod tidy` changed no other modules and left the `go` directive
alone. Verified: `go test ./coderd/jwtutils/...` passes. Local git hooks
were skipped; CI is the gate.

Part of [ENT-227](https://linear.app/codercom/issue/ENT-227) (parent
[ENT-230](https://linear.app/codercom/issue/ENT-230)). Backported to
every supported release line per the backport policy in CONTRIBUTING.md.

Opened by Superblink on behalf of @droopy4096.

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
denisra pushed a commit that referenced this pull request Nov 2, 2026
@coder
fix: bump go-jose/v4 to v4.1.6 (backport 2.36) (#31447)
d228a31 
Backport of the go-jose bump to `release/2.36` (same change as #31440
for 2.38; main is already on v4.1.6). Bumps
`github.com/go-jose/go-jose/v4` from v4.1.4 to v4.1.6, fixing
CVE-2026-116587 /
[GHSA-mgcc-cww5-fp2q](GHSA-mgcc-cww5-fp2q)
(CPU DoS through crafted RSA JWKs). Flagged by the IronBank VAT scan of
2.38.3.

`go mod tidy` changed no other modules and left the `go` directive
alone. Verified: `go test ./coderd/jwtutils/...` passes. Local git hooks
were skipped; CI is the gate.

Part of [ENT-227](https://linear.app/codercom/issue/ENT-227) (parent
[ENT-230](https://linear.app/codercom/issue/ENT-230)). Backported to
every supported release line per the backport policy in CONTRIBUTING.md.

Opened by Superblink on behalf of @droopy4096.

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>
denisra
denisra approved these changes Nov 2, 2026
View reviewed changes
@denisra
denisra merged commit ebe7031 into release/2.38 Nov 2, 2026
29 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@denisra
denisra deleted the superblink/ent-227-go-jose-416-release-238 branch November 2, 2026 19:27
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 2, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@denisra denisra denisra approved these changes
@zenithwolf1000 zenithwolf1000 Awaiting requested review from zenithwolf1000
@jdomeracki-coder jdomeracki-coder Awaiting requested review from jdomeracki-coder

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@droopy4096 droopy4096

Labels

cherry-pick/v2.38 Cherry-pick PR targeting release/2.38 community Pull Requests and issues created by the community.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@denisra @droopy4096
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.