EK
Product
Eclipse KeyPont - GOSE
9
CVEs
0
On KEV
8.8
Max CVSS
9
New 30D
Severity mix
Critical 0High 1Medium 8Low 0
Watch
Add Eclipse KeyPont - GOSE to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-89318 New | 6.9 | Oct 23 | JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) Affected: 0.8.0 through 0.13.0-rc1; before 1.0.0-rc4 |
| CVE-2026-89315 New | 6.9 | Oct 23 | JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix Affected: 0.7.3 through 0.13.0-rc1; before 1.0.0-rc4 |
| CVE-2026-89314 New | 6.9 | Oct 23 | Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s Affected: 0.7.3 through 0.13.0-rc1; before 1.0.0-rc4 |
| CVE-2026-89312 New | 6.9 | Oct 23 | AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV Affected: 0.7.3 through 0.13.0-rc1; before 1.0.0-rc4 |
| CVE-2026-89319 New | 6.3 | Oct 23 | JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation Affected: 0.9.0 through 0.13.0-rc1; before 1.0.0-rc1 |
| CVE-2026-89317 New | 6.3 | Oct 23 | JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) Affected: 0.7.3 through 0.13.0-rc1; before 1.0.0-rc4 |
| CVE-2026-89316 New | 6.3 | Oct 23 | LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion Affected: 0.7.3 through 0.13.0-rc1; before 1.0.0-rc4 |
| CVE-2026-89313 New | 6.3 | Oct 23 | JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil Affected: 0.7.5 through 0.13.0-rc1; before 1.0.0-rc4 |
Showing 8