CVE-2026-89316: CWE-248 Uncaught Exception in Eclipse Foundation Eclipse KeyPont - GOSE
Description
CVE-2026-89316 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the function LoadPublicKey performs an unchecked type assertion on an EC key's curve. If a JSON Web Key (JWK) declares a key type "EC" but specifies a non-EC algorithm, this triggers a panic due to the unchecked assertion.
CVSS v4.0
Score 6.3medium
Affected software
Eclipse Foundation
Eclipse KeyPont - GOSE
Eclipse Foundation
Eclipse KeyPont - GOSE
pkg:github/github.com/ThalesGroup/gosepkg:github/github.com/eclipse-keypont/goseRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the LoadPublicKey function resolving an elliptic curve (EC) key's curve using an unchecked type assertion: algToOptsMap[alg].(*ECDSAOptions). According to RFC 7517 §4.4, a JWK can declare a key type "kty":"EC" alongside a non-EC algorithm "alg". When such a JWK is processed, the unchecked assertion fails and causes the program to panic, leading to an uncaught exception (CWE-248).
Potential Impact
This vulnerability causes the application to panic and crash when processing specially crafted JWKs that combine an EC key type with a non-EC algorithm. This can lead to denial of service conditions but does not indicate privilege escalation or data compromise based on the available information.
Mitigation Recommendations
No official patch or fix is currently documented. Users should monitor the Eclipse Foundation advisories for updates. Until a fix is released, avoid processing untrusted or malformed JWKs that might trigger this condition.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-11T13:55:51.267Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb225b4d27ba8daaeddba3
Added to database: 10/23/2026, 09:01:15 UTC
Last enriched: 10/23/2026, 09:15:25 UTC
Last updated: 10/23/2026, 09:15:56 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.