CVE-2026-89315: medium-severity vulnerability in Eclipse KeyPont - GOSE
JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
Eclipse Foundation · Eclipse KeyPont - GOSERelated CVEs — Eclipse KeyPont - GOSE
In the same product, most dangerous first.
CVE-2026-89314MEDIUMQuadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 sEPSS 0.4%CVE-2026-89313MEDIUMJwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nilEPSS 0.3%CVE-2026-89312MEDIUMAesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IVEPSS 0.3%CVE-2026-89318MEDIUMJweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)EPSS 0.2%CVE-2026-89317MEDIUMJwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)EPSS 0.2%CVE-2026-89319MEDIUMJweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocationEPSS 0.2%