Status: UPDATED | Advisory ID: CVE-2026-34986
| CVE | CVE-2026-34986 |
| CVSS Score / Version | |
| Updated | 2026-10-23 |
| CVSS Vector | |
| CVSS Prose | |
| Affected products | |
| Classified as |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Red Hat | Red Hat OpenShift AI 3.3 | ||
| Red Hat | Red Hat OpenShift AI (RHOAI) | ||
| Red Hat | Red Hat OpenShift AI 2.25 | ||
| Red Hat | Red Hat Enterprise Linux 10 | ||
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | ||
| Red Hat | Red Hat Enterprise Linux 8 | ||
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | ||
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | ||
| Red Hat | Red Hat Enterprise Linux 9 | ||
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | ||
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | ||
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | ||
| Red Hat | Red Hat OpenShift Container Platform 4.12 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.13 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.16 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.17 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.18 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.19 | ||
| Red Hat | Red Hat OpenShift Container Platform 4 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.20 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.21 | ||
| Red Hat | Red Hat OpenShift Container Platform 4.22 | ||
| Red Hat | Confidential Compute Attestation | ||
| Red Hat | Red Hat Quay 3.10 | ||
| Red Hat | Red Hat Quay 3.12 | ||
| Red Hat | Red Hat Quay 3.14 | ||
| Red Hat | Red Hat Quay 3.15 | ||
| Red Hat | Red Hat Quay 3.16 | ||
| Red Hat | Red Hat Quay 3.17 | ||
| Red Hat | Red Hat Quay 3.9 | ||
| Red Hat | Red Hat Ansible Automation Platform 2 | ||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | ||
| Red Hat | Red Hat Openshift Data Foundation 4 | ||
| Red Hat | OpenShift Developer Tools and Services | ||
| Red Hat | Migration Toolkit for Virtualization | ||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | ||
| Red Hat | Red Hat Quay 3.18 | ||
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | ||
| Red Hat | multicluster engine for Kubernetes 2.6 | ||
| Red Hat | multicluster engine for Kubernetes 2.8 | ||
| Red Hat | Red Hat Advanced Cluster Security 4.9 | ||
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | ||
| Red Hat | Red Hat Migration Toolkit 1.8 | ||
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | ||
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | ||
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | ||
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | ||
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | ||
| Red Hat | Red Hat Trusted Artifact Signer 1.3 | ||
| Red Hat | Multicluster Engine for Kubernetes | ||
| Red Hat | OpenShift Pipelines | ||
| Red Hat | OpenShift Service Mesh 3 | ||
| Red Hat | Red Hat Quay 3 | ||
| go-jose_project | go-jose | ||
| go-jose | go-jose | ||
| Red Hat | Cryostat 4 on RHEL 9 | ||
| Red Hat | Custom Metric Autoscaler 2.19 | ||
| Red Hat | Logging for Red Hat OpenShift 6 | ||
| Red Hat | Logging for Red Hat OpenShift 6.2 | ||
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.4 | ||
| Red Hat | multicluster engine for Kubernetes 2.1 | ||
| Red Hat | multicluster engine for Kubernetes 2.11 | ||
| Red Hat | multicluster engine for Kubernetes 2.7 | ||
| Red Hat | multicluster engine for Kubernetes 2.9 | ||
| Red Hat | Multicluster Global Hub 1.3.4 | ||
| Red Hat | Multicluster Global Hub 1.4.5 | ||
| Red Hat | Multicluster Global Hub 1.6.5 | ||
| Red Hat | OpenShift API for Data Protection 1.3 | ||
| Red Hat | OpenShift API for Data Protection 1.4 | ||
| Red Hat | OpenShift API for Data Protection 1.5 | ||
| Red Hat | Red Hat Advanced Cluster Security 4.8 | ||
| Red Hat | Red Hat multicluster global hub 1.5.3 | ||
| Red Hat | Red Hat Openshift Data Foundation 4.17 | ||
| Red Hat | Red Hat Openshift Data Foundation 4.18 | ||
| Red Hat | Red Hat Openshift Data Foundation 4.19 | ||
| Red Hat | Red Hat Openshift Data Foundation 4.20 | ||
| Red Hat | Red Hat Openshift Data Foundation 4.21 | ||
| Red Hat | Red Hat Openshift Data Foundation 4.22 | ||
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 | ||
| Red Hat | Red Hat OpenShift Dev Spaces 3.30 | ||
| Red Hat | Red Hat OpenShift distributed tracing 3.9.3 | ||
| Red Hat | Red Hat OpenShift GitOps 1.18 | ||
| Red Hat | Red Hat OpenShift Pipelines 1.2 | ||
| Red Hat | Red Hat OpenShift Pipelines 1.21 | ||
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 | ||
| Red Hat | cert-manager Operator for Red Hat OpenShift | ||
| Red Hat | Kernel Module Management Operator for Red Hat Openshift | ||
| Red Hat | Logging Subsystem for Red Hat OpenShift | ||
| Red Hat | Multicluster Global Hub | ||
| Red Hat | OpenShift Serverless | ||
| Red Hat | Red Hat Build of Podman Desktop | ||
| Red Hat | Red Hat Build of Podman Desktop - Tech Preview | ||
| Red Hat | Red Hat Connectivity Link 1 | ||
| Red Hat | Red Hat OpenShift Cluster Manager CLI | ||
| Red Hat | Red Hat OpenShift GitOps | ||
| Red Hat | Red Hat OpenShift on AWS | ||
| Red Hat | Red Hat Trusted Artifact Signer | ||
| Red Hat | Security Profiles Operator | ||
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview |
| Subsystems | OT Supporting Infrastructure |
| Sectors | Multiple |
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5. (NVD)
Monitor Red Hat, go-jose_project, and go-jose's web pages for any future patch releases. See vendor advisory link below.