Eclipse KeyPont - GOSE vulnerabilities and CVEs

Known vulnerabilities affecting Eclipse KeyPont - GOSE, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

9 vulnerabilities tracked.

• 8.8 HmacShaCryptor.Hash never hashed its input. CVE-2026-89320 23 Oct 2026
• 6.9 JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. CVE-2026-89318 23 Oct 2026
• 6.9 JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. CVE-2026-89315 23 Oct 2026
• 6.9 jwkFields.CheckConsistency detected duplicate keyops entries with a pairwise nested loop, making validation cost grow with the square of… CVE-2026-89314 23 Oct 2026
• 6.9 AesGcmCryptor.Open passed a caller-supplied nonce straight to cipher.AEAD.Open without checking its length. CVE-2026-89312 23 Oct 2026
• 6.3 JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the thalesaad protected-header field and used it without any validation. CVE-2026-89319 23 Oct 2026
• 6.3 gose parsed the JWS crit header into JwsHeader.Crit and then never read it. CVE-2026-89317 23 Oct 2026
• 6.3 LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMap[alg].(ECDSAOptions). CVE-2026-89316 23 Oct 2026
• 6.3 JwksTrustStore.Get assigned each parsed key to the function's named return value while refreshing the JWKS cache. CVE-2026-89313 23 Oct 2026