Root has patched CVE-2026-34986 in the rootio-github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available.
{ "distro_version": "", "source": "Root", "distro": "gobinary" }
true
"https://api.root.io/external/osv/ROOT-APP-GOBINARY-CVE-2026-34986.json"
1.0
[ "v4.1.0-root.io.1" ]
""
"v4.1.0-root.io.1"