All vulnerabilities
CVE-2026-89315GHSA-hwm6-rwv6-xgq8

Eclipse KeyPont - GOSE: JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

Eclipse Foundation Eclipse KeyPont - GOSE
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.0-rc4Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.

Text from CVE List

Affected versions 2

  • Eclipse KeyPont - GOSEaffected: 0.7.3 through 0.13.0-rc1CVE List
  • Eclipse KeyPont - GOSEaffected: all versions before 1.0.0-rc4CVE List

References 1