From c08a19b83f376989c6068fcb55887cd381004f71 Mon Sep 17 00:00:00 2001 From: Sebastian Szyja Date: Wed, 28 Oct 2026 12:37:26 +0100 Subject: [PATCH 1/4] fix(edge): build Caddy with go-jose v4.1.6 go-jose v4.1.5 in the rebuilt Caddy binary is affected by CVE-2026-116587 (GHSA-mgcc-cww5-fp2q, DoS when parsing JWKs with RSA keys); 4.1.6 fixes it. go.mod and go.sum updated with go get and go mod tidy; go mod verify is clean. --- docker/edge/caddy/go.mod | 2 +- docker/edge/caddy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docker/edge/caddy/go.mod b/docker/edge/caddy/go.mod index fe1e928..270337d 100644 --- a/docker/edge/caddy/go.mod +++ b/docker/edge/caddy/go.mod @@ -47,7 +47,7 @@ require ( github.com/fxamacker/cbor/v2 v2.9.4 // indirect github.com/go-chi/chi/v5 v5.3.2 // indirect github.com/go-jose/go-jose/v3 v3.0.5 // indirect - github.com/go-jose/go-jose/v4 v4.1.5 // indirect + github.com/go-jose/go-jose/v4 v4.1.6 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-sql-driver/mysql v1.10.1 // indirect diff --git a/docker/edge/caddy/go.sum b/docker/edge/caddy/go.sum index 5f3c502..b123e78 100644 --- a/docker/edge/caddy/go.sum +++ b/docker/edge/caddy/go.sum @@ -161,8 +161,8 @@ github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ= github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ= -github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA= -github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4= +github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From 3f2e70b75dd65660b928778bf852a6c162af4115 Mon Sep 17 00:00:00 2001 From: Sebastian Szyja Date: Wed, 28 Oct 2026 12:37:26 +0100 Subject: [PATCH 2/4] docs(security): triage CVE-2026-116587 in the edge Caddy binary Record that the go-jose v4 path is fixed and that go-jose v3 3.0.5 stays: it is linked through caddypki, which caddytls, httpcaddyfile and therefore caddyhttp import, so no Caddy module selection removes it. State why FlowCRM's configuration does not reach the code and that the finding still fails the edge prod gate. --- docs/security/container-vulnerabilities.md | 37 ++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/docs/security/container-vulnerabilities.md b/docs/security/container-vulnerabilities.md index bf58b60..2005574 100644 --- a/docs/security/container-vulnerabilities.md +++ b/docs/security/container-vulnerabilities.md @@ -185,6 +185,43 @@ project's own health checks do not use `curl` (they use `cgi-fcgi` and Remove the upgrade when the pinned base images include the fix. No exception was added. +## CVE-2026-116587 / GHSA-mgcc-cww5-fp2q: `go-jose` (edge) + +Published by go-jose on 2026-10-14 and added to the GitHub advisory database +(HIGH) on 2026-10-27, after the last green scan of `main`; not caused by a +change of the project. Parsing a JWK with a crafted RSA key costs excessive +CPU (denial of service). The rebuilt Caddy binary (`usr/bin/caddy`, edge +`prod` and `dev`) contains both affected major versions: + +| Package | Installed | Fixed in | Status | +|---|---|---|---| +| `github.com/go-jose/go-jose/v4` | 4.1.5 | 4.1.6 | **fixed**: `docker/edge/caddy/go.mod` requires 4.1.6 | +| `github.com/go-jose/go-jose/v3` | 3.0.5 | none (no fixed v3 release) | **open** | + +`go-jose/v3` comes from `modules/caddypki` → `github.com/smallstep/certificates/authority` +→ `go.step.sm/crypto/jose` (0.91.0; the newest, 0.91.1, still requires +v3). It cannot be removed by building Caddy without `modules/caddypki`: +`modules/caddytls` (internal issuer and CA pools) and +`caddyconfig/httpcaddyfile` import `caddypki` directly, and +`modules/caddyhttp` imports `caddytls`, so every Caddy build with the HTTP +app links it. A build from the `modules/standard` list without `caddypki` +and `caddypki/acmeserver` still contains `go-jose/v3` 3.0.5 (`go version -m`) +and only drops the `http.handlers.acme_server` module. Removing v3 needs +either a release of `go.step.sm/crypto` and `smallstep/certificates` on +go-jose v4, or a change to Caddy itself. + +FlowCRM's configuration does not reach the vulnerable code: both +Caddyfiles disable automatic HTTPS (`auto_https off`), no configuration +defines a `pki` app, `tls internal` or `acme_server`, and the HTTPS test +edge (`tests/app/https`) loads its certificate from files +(`tls.certificates.load_files`). Only the `acme_server` handler passes +untrusted input (the JWS of an ACME request) to the vulnerable parser; +`tls internal` and the `pki` app parse only keys Caddy creates or loads +from its own configuration. With `admin off` the configuration cannot be +changed at run time. The finding still fails the runtime gate +for the edge `prod` image until it is fixed upstream or an exception is +decided. + ## Deferred hardening items - `framework.trusted_hosts` is not configured: behind the edge, Symfony From 2266471aff22e129f72c785efb68f7bc4c2f1477 Mon Sep 17 00:00:00 2001 From: Sebastian Szyja Date: Wed, 28 Oct 2026 12:53:36 +0100 Subject: [PATCH 3/4] docs(security): cite the scan runs of CVE-2026-116587 and link it from the Caddy triage --- docs/security/container-vulnerabilities.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/docs/security/container-vulnerabilities.md b/docs/security/container-vulnerabilities.md index 2005574..2c1b28e 100644 --- a/docs/security/container-vulnerabilities.md +++ b/docs/security/container-vulnerabilities.md @@ -77,7 +77,9 @@ clean) with `golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca` and `golang.org/x/net` 0.60.0; the official 2.11.7 image provides the base layer. `caddy version` reports `v2.11.7`. Result: **0 HIGH/CRITICAL** (was 24 -with the 2.11.4 release binary, 5 with the 2.11.7 release binary). +with the 2.11.4 release binary, 5 with the 2.11.7 release binary). Since +2026-10-27 the binary has a `go-jose` finding again; see +[CVE-2026-116587](#cve-2026-116587--ghsa-mgcc-cww5-fp2q-go-jose-edge). Triage of the 2.11.4 release binary: @@ -188,8 +190,9 @@ was added. ## CVE-2026-116587 / GHSA-mgcc-cww5-fp2q: `go-jose` (edge) Published by go-jose on 2026-10-14 and added to the GitHub advisory database -(HIGH) on 2026-10-27, after the last green scan of `main`; not caused by a -change of the project. Parsing a JWK with a crafted RSA key costs excessive +(HIGH) on 2026-10-27, after the last green scan of `main` (run 40407409241, +2026-10-26); found by the scan of PR #40 (run 40671261985, 2026-10-28), not +caused by a change of the project. Parsing a JWK with a crafted RSA key costs excessive CPU (denial of service). The rebuilt Caddy binary (`usr/bin/caddy`, edge `prod` and `dev`) contains both affected major versions: From cf9dc3e8af0c2bf13e99aa35fb68ef06640f718f Mon Sep 17 00:00:00 2001 From: Sebastian Szyja Date: Wed, 28 Oct 2026 12:53:53 +0100 Subject: [PATCH 4/4] docs(security): rewrap the CVE-2026-116587 introduction --- docs/security/container-vulnerabilities.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/security/container-vulnerabilities.md b/docs/security/container-vulnerabilities.md index 2c1b28e..b4c9bac 100644 --- a/docs/security/container-vulnerabilities.md +++ b/docs/security/container-vulnerabilities.md @@ -192,9 +192,10 @@ was added. Published by go-jose on 2026-10-14 and added to the GitHub advisory database (HIGH) on 2026-10-27, after the last green scan of `main` (run 40407409241, 2026-10-26); found by the scan of PR #40 (run 40671261985, 2026-10-28), not -caused by a change of the project. Parsing a JWK with a crafted RSA key costs excessive -CPU (denial of service). The rebuilt Caddy binary (`usr/bin/caddy`, edge -`prod` and `dev`) contains both affected major versions: +caused by a change of the project. Parsing a JWK with a crafted RSA key +costs excessive CPU (denial of service). The rebuilt Caddy binary +(`usr/bin/caddy`, edge `prod` and `dev`) contains both affected major +versions: | Package | Installed | Fixed in | Status | |---|---|---|---|