CVE-2026-89319: CWE-129 Improper Validation of Array Index in Eclipse Foundation Eclipse KeyPont - GOSE
Description
CVE-2026-89319 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the Decrypt function improperly validates a 64-bit plaintext length read from a protected header field. This can cause panics due to truncated or oversized values, leading to unbounded memory allocation or slice-bounds errors.
CVSS v4.0
Score 6.3medium
Affected software
Eclipse Foundation
Eclipse KeyPont - GOSE
Eclipse Foundation
Eclipse KeyPont - GOSE
pkg:github/github.com/ThalesGroup/gosepkg:github/github.com/eclipse-keypont/goseRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability occurs in the JweDirectDecryptorBlock.Decrypt method of Eclipse KeyPont - GOSE. It reads a 64-bit plaintext length from the _thales_aad protected-header field without validation. If the field is truncated, it causes a panic in binary.BigEndian.Uint64. If the value is oversized, it triggers an unbounded memory allocation. If the value exceeds the decrypted block size, it causes a slice-bounds panic. These issues stem from improper validation of array indices, classified as CWE-129.
Potential Impact
Exploitation of this vulnerability can cause application crashes due to panics or excessive memory allocation, potentially leading to denial of service. There is no indication of privilege escalation or data disclosure. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector with high attack complexity and low impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No patch or official fix is currently available as per the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider avoiding processing untrusted input in the affected versions or apply any vendor-recommended workarounds once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-09-11T13:55:57.103Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb25cc4d27ba8daaefef48
Added to database: 10/23/2026, 09:15:56 UTC
Last enriched: 10/23/2026, 09:30:33 UTC
Last updated: 10/23/2026, 09:30:33 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.