consul v4.1.7

Fixed Security Issues

• Thumbprint: reject invalid RSA key (#317) - GHSA-r39w-98wm-9pp6
• json: backport stdlib fix for embedded unexported field (#318) - GHSA-27pc-rm86-68pq
• Detect if headers are set by presence in the map (#319) - GHSA-p9j4-2j95-j4rv
• limit RSA size in certificate verify (#315) - GHSA-v6h2-qj3f-2h6v
• Limit recipients and signatures in JWE/JWS (#316) - GHSA-c67m-wr4h-2ccg

Fixed

• jwk: fix bug in x5c parsing (#311)
• reject base64-encoded “null” in protected headers (#309)

Deprecated

• deprecate ParseEncrypted / ParseSigned (#222)

---

Source go-jose/go-jose · v4.1.7 · 2026-10-30 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.