Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:10135 advisory.

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-853a2fa7e5 advisory.

    - Update to release v29.4.0
    - Resolves: rhbz#2455894
    - Resolves  CVE-2026-34986: rhbz#2455665
    - Upstream new features and fixes

    ----

    - Update to release v29.3.1
    - Resolves: rhbz#2451425
    - Upstream notes that this release resolves: CVE-2026-34040,       CVE-2026-33997, CVE-2026-33748, CVE-2026-33747
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-af08c3b44f advisory.

    Fix CVE-2026-34986 in bundled go-jose

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-605559bfe2 advisory.

    Automatic update for buildah-1.43.1-1.fc44, podman-5.8.2-1.fc44, skopeo-1.22.2-1.fc44.

    ##### **Changelog for buildah**

    ```
    * Wed Apr 08 2026 Packit <hello@packit.dev> - 2:1.43.1-1
    - Update to 1.43.1 upstream release

    ```

    ##### **Changelog for podman**

    ```
    * Tue Apr 14 2026 Packit <hello@packit.dev> - 5:5.8.2-1
    - Update to 5.8.2 upstream release

    ```

    ##### **Changelog for skopeo**

    ```
    * Tue Apr 14 2026 Packit <hello@packit.dev> - 1:1.22.2-1
    - Update to 1.22.2 upstream release

    * Fri Apr 10 2026 Lokesh Mandvekar <lsm5@redhat.com> - 1:1.22.1-2
    - TMT: fix ref in plan

    * Thu Apr 09 2026 Packit <hello@packit.dev> - 1:1.22.1-1
    - Update to 1.22.1 upstream release

    ```

    ----

    Security fix for CVE-2026-34986

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-10135 advisory.

    - rebuild for CVE-2026-34986

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:10135 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-245867ac28 advisory.

    Fix CVE-2026-34986 in bundled go-jose

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-48994e5a45 advisory.

    Fix CVE-2026-34986 in bundled go-jose

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-75c2b7868a advisory.

    Automatic update for skopeo-1.22.2-1.fc43, podman-5.8.2-1.fc43, buildah-1.43.1-1.fc43.

    ##### **Changelog for skopeo**

    ```
    * Tue Apr 14 2026 Packit <hello@packit.dev> - 1:1.22.2-1
    - Update to 1.22.2 upstream release

    * Fri Apr 10 2026 Lokesh Mandvekar <lsm5@redhat.com> - 1:1.22.1-2
    - TMT: fix ref in plan

    * Thu Apr 09 2026 Packit <hello@packit.dev> - 1:1.22.1-1
    - Update to 1.22.1 upstream release

    ```

    ##### **Changelog for podman**

    ```
    * Tue Apr 14 2026 Packit <hello@packit.dev> - 5:5.8.2-1
    - Update to 5.8.2 upstream release

    ```

    ##### **Changelog for buildah**

    ```
    * Wed Apr 08 2026 Packit <hello@packit.dev> - 2:1.43.1-1
    - Update to 1.43.1 upstream release

    ```

    ----

    Security fix for CVE-2026-34986

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a5015b57b9 advisory.

    - Update to release v29.4.0
    - Resolves: rhbz#2455894
    - Resolves  CVE-2026-34986: rhbz#2455665
    - Upstream new features and fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-49fd0d9636 advisory.

    - Update to release v29.4.0
    - Resolves: rhbz#2455894
    - Resolves  CVE-2026-34986: rhbz#2455665
    - Upstream new features and fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e520168745 advisory.

    Automatic update for moby-engine-29.4.0-1.fc45.

    ##### **Changelog**

    ```
    * Tue Apr  7 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 29.4.0-1
    - Update to release v29.4.0
    - Resolves: rhbz#2455894
    - Resolves  CVE-2026-34986: rhbz#2455665
    - Upstream new features and fixes

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,     including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT)     standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg     field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW,     and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in     key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the     encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() /     ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take     a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping     algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by     calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling     this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed     in 4.1.4 and 3.0.5. (CVE-2026-34986)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310565	RockyLinux 9 : buildah (RLSA-2026:10135)	Nessus	Rocky Linux Local Security Checks	high
310540	Fedora 44 : moby-engine (2026-853a2fa7e5)	Nessus	Fedora Local Security Checks	high
310430	Fedora 44 : opkssh (2026-af08c3b44f)	Nessus	Fedora Local Security Checks	high
310216	Fedora 44 : buildah / podman / skopeo (2026-605559bfe2)	Nessus	Fedora Local Security Checks	high
310155	Oracle Linux 9 : buildah (ELSA-2026-10135)	Nessus	Oracle Linux Local Security Checks	high
310142	RHEL 9 : buildah (RHSA-2026:10135)	Nessus	Red Hat Local Security Checks	high
309738	Fedora 42 : opkssh (2026-245867ac28)	Nessus	Fedora Local Security Checks	high
307696	Fedora 43 : opkssh (2026-48994e5a45)	Nessus	Fedora Local Security Checks	high
306848	Fedora 43 : buildah / podman / skopeo (2026-75c2b7868a)	Nessus	Fedora Local Security Checks	high
306612	Fedora 43 : moby-engine (2026-a5015b57b9)	Nessus	Fedora Local Security Checks	high
306610	Fedora 42 : moby-engine (2026-49fd0d9636)	Nessus	Fedora Local Security Checks	high
305239	Fedora 45 : moby-engine (2026-e520168745)	Nessus	Fedora Local Security Checks	high
305116	Linux Distros Unpatched Vulnerability : CVE-2026-34986	Nessus	Misc.	high

Detections

Analytics

CVE-2026-34986

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high