azure linux dcos-cli vulnerabilities

Latest azure linux dcos-cli CVEs

Newest publication first

1. CVE-2026-116587 Go JOSE: DoS when parsing JWKs that contain RSA keys

   Published 2026-10-26

   High·CVSS 7.5

   Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus...

2. CVE-2026-116586 Go JOSE: Panics in JSON parsing

   Published 2026-10-26

   Medium·CVSS 6.9

   Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jo...

3. CVE-2026-116585 Go JOSE: Panic during CBC-HMAC processing

   Published 2026-10-26

   Medium·CVSS 6.9

   Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128C...

4. CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text

   Published 2026-07-21

   High·CVSS 7.5

   A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

5. CVE-2025-65637 Logrus is vulnerable to DoS when using Entry.Writer()

   Published 2025-12-04

   High·CVSS 7.5 PoC

   A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is...

6. CVE-2025-27144 Go JOSE's Parsing Vulnerable to Denial of Service

   Published 2025-02-24

   Medium·CVSS 6.6

   Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when par...

7. CVE-2024-51744 Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt

   Published 2024-11-04

   Low·CVSS 3.1

   golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors ret...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.