Threat Intelligence Database

CVE-2026-89320 is a high-severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the HmacShaCryptor.Hash function fails to hash its input and always returns the MAC of an empty message under the key. This flaw causes the authentication tag in AES-CBC-HMAC JSON Web Encryption (JWE) to be constant per key and independent of the message, effectively removing ciphertext integrity.

CVE-2026-89319 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the Decrypt function improperly validates a 64-bit plaintext length read from a protected header field. This can cause panics due to truncated or oversized values, leading to unbounded memory allocation or slice-bounds errors.

CVE-2026-89318 is a vulnerability in Eclipse KeyPont - GOSE where the Decrypt function passes an incorrectly sized initialization vector (IV) to the Go standard library's AEAD Open method without validating its length. This causes the Go library to panic, crashing the decrypting goroutine. The issue affects versions from 0 up to 1.0.0-rc4, including some release candidates. The vulnerability has a medium severity with a CVSS score of 6.9.

CVE-2026-89317 is a medium severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE component. The vulnerability arises because the library parses the JWS 'crit' header but does not enforce the requirement to reject tokens with unrecognized critical extensions, as mandated by RFC 7515 §4.1.11. Since GOSE implements no header extensions, any token with a non-empty 'crit' header should have been rejected but was not.

CVE-2026-89316 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the function LoadPublicKey performs an unchecked type assertion on an EC key's curve. If a JSON Web Key (JWK) declares a key type "EC" but specifies a non-EC algorithm, this triggers a panic due to the unchecked assertion.

CVE-2026-89315 is a vulnerability in Eclipse KeyPont - GOSE where the JwtClaims.MarshalJSON function uses Go's reflect.StructOf to dynamically create struct fields for JWT claims. This function panics if a claim name is not a valid Go identifier or duplicates another field name, conditions which can be triggered by ordinary JWT claim names. The vulnerability affects multiple versions of the product up to 1.0.0-rc4. It has a CVSS 4.0 score of 6.9, indicating medium severity.

CVE-2026-89314 is a medium severity vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE. It involves an inefficient algorithmic complexity issue in the jwkFields.CheckConsistency function, which uses a pairwise nested loop to detect duplicate key_ops entries. This causes the validation cost to grow quadratically with the number of entries. Since this check runs on every JWK and JWKS unmarshal, a specially crafted JWKS document could cause significant CPU consumption, potentially occupying a CPU core for many seconds.

CVE-2026-89313 is a medium severity vulnerability in Eclipse KeyPont - GOSE where the function JwksTrustStore.Get incorrectly returns the last key in the JWKS document when a requested key ID (kid) is not found, instead of signaling a 'not found' error. This occurs due to the use of a named return value and a naked return statement that returns the last parsed key with a nil error. This behavior can cause callers to receive incorrect key data, potentially leading to trust or validation issues.

CVE-2026-89312 is a vulnerability in Eclipse Foundation's Eclipse KeyPont - GOSE where the AesGcmCryptor.Open function passes a caller-supplied nonce directly to cipher.AEAD.Open without validating its length. The Go standard library panics if the GCM nonce length is incorrect, causing the decrypting goroutine to crash when processing a JWE with a wrong-sized IV. This affects multiple versions of the product prior to 1.0.0-rc4.