Search
Find a vulnerability
Search criteria
18 vulnerabilities found for Eclipse KeyPont - GOSE by Eclipse Foundation
CVE-2026-89320 (GCVE-0-2026-89320)
Vulnerability from nvd – Published: 2026-10-23 08:56 – Updated: 2026-10-23 08:56
VLAI
EPSS
VEX
Title
HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity
Summary
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.
Severity
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.9.0 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` \u2014 the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.\u003c/p\u003e"
}
],
"value": "`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` \u2014 the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "CWE-354 Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:56:20.140Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HmacShaCryptor.Hash never hashes its input \u2014 returns constant HMAC_K(\"\") for all inputs, voiding CBC-HMAC JWE integrity",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89320",
"datePublished": "2026-10-23T08:56:20.140Z",
"dateReserved": "2026-09-11T13:55:59.296Z",
"dateUpdated": "2026-10-23T08:56:20.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89319 (GCVE-0-2026-89319)
Vulnerability from nvd – Published: 2026-10-23 08:54 – Updated: 2026-10-23 08:54
VLAI
EPSS
VEX
Title
JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
Summary
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
Severity
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.9.0 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.\u003c/p\u003e"
}
],
"value": "`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:54:37.681Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-4gj8-hg2r-gw6q"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag \u2192 index-out-of-range / slice-bounds panic and unbounded allocation",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89319",
"datePublished": "2026-10-23T08:54:37.681Z",
"dateReserved": "2026-09-11T13:55:57.103Z",
"dateUpdated": "2026-10-23T08:54:37.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89318 (GCVE-0-2026-89318)
Vulnerability from nvd – Published: 2026-10-23 08:51 – Updated: 2026-10-23 08:51
VLAI
EPSS
VEX
Title
JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
Summary
`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.8.0 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE\u0027s initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.\u003c/p\u003e"
}
],
"value": "`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE\u0027s initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:51:55.194Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-265w-83cm-777q"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89318",
"datePublished": "2026-10-23T08:51:55.194Z",
"dateReserved": "2026-09-11T13:55:55.054Z",
"dateUpdated": "2026-10-23T08:51:55.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89317 (GCVE-0-2026-89317)
Vulnerability from nvd – Published: 2026-10-23 08:50 – Updated: 2026-10-23 08:50
VLAI
EPSS
VEX
Title
JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
Summary
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
Severity
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003egose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 \u00a74.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected \u2014 and none were.\u003c/p\u003e"
}
],
"value": "gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 \u00a74.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected \u2014 and none were."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:50:22.987Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-445r-fpvv-hgwc"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 \u00a74.1.11)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89317",
"datePublished": "2026-10-23T08:50:22.987Z",
"dateReserved": "2026-09-11T13:55:53.128Z",
"dateUpdated": "2026-10-23T08:50:22.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89316 (GCVE-0-2026-89316)
Vulnerability from nvd – Published: 2026-10-23 08:48 – Updated: 2026-10-23 08:48
VLAI
EPSS
VEX
Title
LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
Summary
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`LoadPublicKey` resolved an EC key\u0027s curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `\"kty\":\"EC\"` together with a non-EC `\"alg\"` \u2014 which RFC 7517 \u00a74.4 permits \u2014 reaches that assertion and **panics**.\u003c/p\u003e"
}
],
"value": "`LoadPublicKey` resolved an EC key\u0027s curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `\"kty\":\"EC\"` together with a non-EC `\"alg\"` \u2014 which RFC 7517 \u00a74.4 permits \u2014 reaches that assertion and **panics**."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:48:08.682Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89316",
"datePublished": "2026-10-23T08:48:08.682Z",
"dateReserved": "2026-09-11T13:55:51.267Z",
"dateUpdated": "2026-10-23T08:48:08.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89315 (GCVE-0-2026-89315)
Vulnerability from nvd – Published: 2026-10-23 08:46 – Updated: 2026-10-23 08:46
VLAI
EPSS
VEX
Title
JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
Summary
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `\"A\" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.\u003c/p\u003e"
}
],
"value": "`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `\"A\" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:46:30.146Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-hwm6-rwv6-xgq8"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89315",
"datePublished": "2026-10-23T08:46:30.146Z",
"dateReserved": "2026-09-11T13:55:49.179Z",
"dateUpdated": "2026-10-23T08:46:30.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89314 (GCVE-0-2026-89314)
Vulnerability from nvd – Published: 2026-10-23 08:43 – Updated: 2026-10-23 08:43
VLAI
EPSS
VEX
Title
Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
Summary
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.\u003c/p\u003e"
}
],
"value": "`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:43:38.475Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-r56w-f43c-828p"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89314",
"datePublished": "2026-10-23T08:43:38.475Z",
"dateReserved": "2026-09-11T13:55:47.027Z",
"dateUpdated": "2026-10-23T08:43:38.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89313 (GCVE-0-2026-89313)
Vulnerability from nvd – Published: 2026-10-23 08:40 – Updated: 2026-10-23 08:40
VLAI
EPSS
VEX
Title
JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
Summary
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
Severity
CWE
- CWE-706 - Use of Incorrectly-Resolved Name or Reference
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.5 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JwksTrustStore.Get` assigned each parsed key to the function\u0027s **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error \u2014 a confidently wrong answer instead of \"not found\".\u003c/p\u003e"
}
],
"value": "`JwksTrustStore.Get` assigned each parsed key to the function\u0027s **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error \u2014 a confidently wrong answer instead of \"not found\"."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706 Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:40:55.499Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89313",
"datePublished": "2026-10-23T08:40:55.499Z",
"dateReserved": "2026-09-11T13:55:44.985Z",
"dateUpdated": "2026-10-23T08:40:55.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89312 (GCVE-0-2026-89312)
Vulnerability from nvd – Published: 2026-10-23 08:36 – Updated: 2026-10-23 08:36
VLAI
EPSS
VEX
Title
AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV
Summary
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.\u003c/p\u003e"
}
],
"value": "`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:36:53.971Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-xx6h-2jgg-93m2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89312",
"datePublished": "2026-10-23T08:36:53.971Z",
"dateReserved": "2026-09-11T13:55:42.953Z",
"dateUpdated": "2026-10-23T08:36:53.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89320 (GCVE-0-2026-89320)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:56 – Updated: 2026-10-23 08:56
VLAI
EPSS
VEX
Title
HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity
Summary
`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.
Severity
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.9.0 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` \u2014 the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.\u003c/p\u003e"
}
],
"value": "`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K(\"\")` \u2014 the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "CWE-354 Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:56:20.140Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-h6w5-722x-2h3m"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HmacShaCryptor.Hash never hashes its input \u2014 returns constant HMAC_K(\"\") for all inputs, voiding CBC-HMAC JWE integrity",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89320",
"datePublished": "2026-10-23T08:56:20.140Z",
"dateReserved": "2026-09-11T13:55:59.296Z",
"dateUpdated": "2026-10-23T08:56:20.140Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89319 (GCVE-0-2026-89319)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:54 – Updated: 2026-10-23 08:54
VLAI
EPSS
VEX
Title
JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
Summary
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
Severity
CWE
- CWE-129 - Improper Validation of Array Index
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.9.0 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.9.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.\u003c/p\u003e"
}
],
"value": "`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-129",
"description": "CWE-129 Improper Validation of Array Index",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:54:37.681Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-4gj8-hg2r-gw6q"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag \u2192 index-out-of-range / slice-bounds panic and unbounded allocation",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89319",
"datePublished": "2026-10-23T08:54:37.681Z",
"dateReserved": "2026-09-11T13:55:57.103Z",
"dateUpdated": "2026-10-23T08:54:37.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89318 (GCVE-0-2026-89318)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:51 – Updated: 2026-10-23 08:51
VLAI
EPSS
VEX
Title
JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
Summary
`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.8.0 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE\u0027s initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.\u003c/p\u003e"
}
],
"value": "`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE\u0027s initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:51:55.194Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-265w-83cm-777q"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89318",
"datePublished": "2026-10-23T08:51:55.194Z",
"dateReserved": "2026-09-11T13:55:55.054Z",
"dateUpdated": "2026-10-23T08:51:55.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89317 (GCVE-0-2026-89317)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:50 – Updated: 2026-10-23 08:50
VLAI
EPSS
VEX
Title
JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
Summary
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
Severity
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003egose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 \u00a74.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected \u2014 and none were.\u003c/p\u003e"
}
],
"value": "gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 \u00a74.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected \u2014 and none were."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1288",
"description": "CWE-1288 Improper Validation of Consistency within Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:50:22.987Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-445r-fpvv-hgwc"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 \u00a74.1.11)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89317",
"datePublished": "2026-10-23T08:50:22.987Z",
"dateReserved": "2026-09-11T13:55:53.128Z",
"dateUpdated": "2026-10-23T08:50:22.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89316 (GCVE-0-2026-89316)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:48 – Updated: 2026-10-23 08:48
VLAI
EPSS
VEX
Title
LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
Summary
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`LoadPublicKey` resolved an EC key\u0027s curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `\"kty\":\"EC\"` together with a non-EC `\"alg\"` \u2014 which RFC 7517 \u00a74.4 permits \u2014 reaches that assertion and **panics**.\u003c/p\u003e"
}
],
"value": "`LoadPublicKey` resolved an EC key\u0027s curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `\"kty\":\"EC\"` together with a non-EC `\"alg\"` \u2014 which RFC 7517 \u00a74.4 permits \u2014 reaches that assertion and **panics**."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:48:08.682Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89316",
"datePublished": "2026-10-23T08:48:08.682Z",
"dateReserved": "2026-09-11T13:55:51.267Z",
"dateUpdated": "2026-10-23T08:48:08.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89315 (GCVE-0-2026-89315)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:46 – Updated: 2026-10-23 08:46
VLAI
EPSS
VEX
Title
JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
Summary
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `\"A\" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.\u003c/p\u003e"
}
],
"value": "`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `\"A\" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:46:30.146Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-hwm6-rwv6-xgq8"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89315",
"datePublished": "2026-10-23T08:46:30.146Z",
"dateReserved": "2026-09-11T13:55:49.179Z",
"dateUpdated": "2026-10-23T08:46:30.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89314 (GCVE-0-2026-89314)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:43 – Updated: 2026-10-23 08:43
VLAI
EPSS
VEX
Title
Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
Summary
`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.\u003c/p\u003e"
}
],
"value": "`jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost grow with the **square** of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407 Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:43:38.475Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-r56w-f43c-828p"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89314",
"datePublished": "2026-10-23T08:43:38.475Z",
"dateReserved": "2026-09-11T13:55:47.027Z",
"dateUpdated": "2026-10-23T08:43:38.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89313 (GCVE-0-2026-89313)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:40 – Updated: 2026-10-23 08:40
VLAI
EPSS
VEX
Title
JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
Summary
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
Severity
CWE
- CWE-706 - Use of Incorrectly-Resolved Name or Reference
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.5 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`JwksTrustStore.Get` assigned each parsed key to the function\u0027s **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error \u2014 a confidently wrong answer instead of \"not found\".\u003c/p\u003e"
}
],
"value": "`JwksTrustStore.Get` assigned each parsed key to the function\u0027s **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error \u2014 a confidently wrong answer instead of \"not found\"."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-706",
"description": "CWE-706 Use of Incorrectly-Resolved Name or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:40:55.499Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-v7r8-g6h9-99vv"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89313",
"datePublished": "2026-10-23T08:40:55.499Z",
"dateReserved": "2026-09-11T13:55:44.985Z",
"dateUpdated": "2026-10-23T08:40:55.499Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89312 (GCVE-0-2026-89312)
Vulnerability from cvelistv5 – Published: 2026-10-23 08:36 – Updated: 2026-10-23 08:36
VLAI
EPSS
VEX
Title
AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV
Summary
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Severity
CWE
- CWE-248 - Uncaught Exception
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0.7.3 , ≤ 0.13.0-rc1
(semver)
|
|
| Eclipse Foundation | Eclipse KeyPont - GOSE |
Affected:
0 , < 1.0.0-rc4
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "github.com/ThalesGroup/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "0.13.0-rc1",
"status": "affected",
"version": "0.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "github.com/eclipse-keypont/gose",
"product": "Eclipse KeyPont - GOSE",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThan": "1.0.0-rc4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.\u003c/p\u003e"
}
],
"value": "`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T08:36:53.971Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-keypont/gose/security/advisories/GHSA-xx6h-2jgg-93m2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-89312",
"datePublished": "2026-10-23T08:36:53.971Z",
"dateReserved": "2026-09-11T13:55:42.953Z",
"dateUpdated": "2026-10-23T08:36:53.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}