Eclipse Foundation Eclipse KeyPont - GOSE vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest Eclipse Foundation Eclipse KeyPont - GOSE vulnerabilities

CVE-2026-89320 — HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity (CVSS 8.8)
CVE-2026-89319 — JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation (CVSS 6.3)
CVE-2026-89318 — JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) (CVSS 6.9)
CVE-2026-89317 — JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) (CVSS 6.3)
CVE-2026-89316 — LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion (CVSS 6.3)
CVE-2026-89315 — JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix (CVSS 6.9)
CVE-2026-89314 — Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s (CVSS 6.9)
CVE-2026-89313 — JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil (CVSS 6.3)
CVE-2026-89312 — AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV (CVSS 6.9)