Skip to content

fix(edge): build Caddy with go-jose v4.1.6 (CVE-2026-116587) #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
knittingcode wants to merge 4 commits into from
Closed

fix(edge): build Caddy with go-jose v4.1.6 (CVE-2026-116587) #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c08a19b
fix(edge): build Caddy with go-jose v4.1.6
knittingcode Oct 28, 2026
3f2e70b
docs(security): triage CVE-2026-116587 in the edge Caddy binary
knittingcode Oct 28, 2026
2266471
docs(security): cite the scan runs of CVE-2026-116587 and link it fro…
knittingcode Oct 28, 2026
cf9dc3e
docs(security): rewrap the CVE-2026-116587 introduction
knittingcode Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docker/edge/caddy/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ require (
github.com/fxamacker/cbor/v2 v2.9.4 // indirect
github.com/go-chi/chi/v5 v5.3.2 // indirect
github.com/go-jose/go-jose/v3 v3.0.5 // indirect
github.com/go-jose/go-jose/v4 v4.1.5 // indirect
github.com/go-jose/go-jose/v4 v4.1.6 // indirect
github.com/go-logr/logr v1.4.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-sql-driver/mysql v1.10.1 // indirect
Expand Down
4 changes: 2 additions & 2 deletions docker/edge/caddy/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,8 +161,8 @@ github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY=
github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
Expand Down
43 changes: 42 additions & 1 deletion docs/security/container-vulnerabilities.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,9 @@ clean) with
`golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca`
and `golang.org/x/net` 0.60.0; the official 2.11.7 image provides the base
layer. `caddy version` reports `v2.11.7`. Result: **0 HIGH/CRITICAL** (was 24
with the 2.11.4 release binary, 5 with the 2.11.7 release binary).
with the 2.11.4 release binary, 5 with the 2.11.7 release binary). Since
2026-10-27 the binary has a `go-jose` finding again; see
[CVE-2026-116587](#cve-2026-116587--ghsa-mgcc-cww5-fp2q-go-jose-edge).

Triage of the 2.11.4 release binary:

Expand Down Expand Up @@ -185,6 +187,45 @@ project's own health checks do not use `curl` (they use `cgi-fcgi` and
Remove the upgrade when the pinned base images include the fix. No exception
was added.

## CVE-2026-116587 / GHSA-mgcc-cww5-fp2q: `go-jose` (edge)

Published by go-jose on 2026-10-14 and added to the GitHub advisory database
(HIGH) on 2026-10-27, after the last green scan of `main` (run 40407409241,
2026-10-26); found by the scan of PR #40 (run 40671261985, 2026-10-28), not
caused by a change of the project. Parsing a JWK with a crafted RSA key
costs excessive CPU (denial of service). The rebuilt Caddy binary
(`usr/bin/caddy`, edge `prod` and `dev`) contains both affected major
versions:

| Package | Installed | Fixed in | Status |
|---|---|---|---|
| `github.com/go-jose/go-jose/v4` | 4.1.5 | 4.1.6 | **fixed**: `docker/edge/caddy/go.mod` requires 4.1.6 |
| `github.com/go-jose/go-jose/v3` | 3.0.5 | none (no fixed v3 release) | **open** |

`go-jose/v3` comes from `modules/caddypki` → `github.com/smallstep/certificates/authority`
→ `go.step.sm/crypto/jose` (0.91.0; the newest, 0.91.1, still requires
v3). It cannot be removed by building Caddy without `modules/caddypki`:
`modules/caddytls` (internal issuer and CA pools) and
`caddyconfig/httpcaddyfile` import `caddypki` directly, and
`modules/caddyhttp` imports `caddytls`, so every Caddy build with the HTTP
app links it. A build from the `modules/standard` list without `caddypki`
and `caddypki/acmeserver` still contains `go-jose/v3` 3.0.5 (`go version -m`)
and only drops the `http.handlers.acme_server` module. Removing v3 needs
either a release of `go.step.sm/crypto` and `smallstep/certificates` on
go-jose v4, or a change to Caddy itself.

FlowCRM's configuration does not reach the vulnerable code: both
Caddyfiles disable automatic HTTPS (`auto_https off`), no configuration
defines a `pki` app, `tls internal` or `acme_server`, and the HTTPS test
edge (`tests/app/https`) loads its certificate from files
(`tls.certificates.load_files`). Only the `acme_server` handler passes
untrusted input (the JWS of an ACME request) to the vulnerable parser;
`tls internal` and the `pki` app parse only keys Caddy creates or loads
from its own configuration. With `admin off` the configuration cannot be
changed at run time. The finding still fails the runtime gate
for the edge `prod` image until it is fixed upstream or an exception is
decided.

## Deferred hardening items

- `framework.trusted_hosts` is not configured: behind the edge, Symfony
Expand Down
Loading