CVE-2026-89315: CWE-248 Uncaught Exception in Eclipse Foundation Eclipse KeyPont - GOSE

The vulnerability arises from JwtClaims.MarshalJSON synthesizing struct fields at runtime using reflect.StructOf with field names prefixed by "A" plus the claim name. reflect.StructOf panics when field names are invalid Go identifiers or duplicate existing fields. Since ordinary JWT claim names can cause these conditions, this leads to an uncaught exception (panic) in the code, potentially causing denial of service or application instability. The affected versions include >=0.7.3 <=0.13.0-rc1 and >=0 <1.0.0-rc4 of Eclipse KeyPont - GOSE.

An attacker can cause the application to panic by submitting JWT claims with names that are invalid Go identifiers or duplicate existing fields, leading to an uncaught exception. This can result in denial of service or application crashes. There is no indication of privilege escalation, data disclosure, or remote code execution. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted JWT claims with potentially invalid or duplicate claim names to prevent triggering the panic.