All vulnerabilities
CVE-2026-89316GHSA-fv39-8484-f4wr

Eclipse KeyPont - GOSE: LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

Eclipse Foundation Eclipse KeyPont - GOSE
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.0-rc4Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMap[alg].(*ECDSAOptions). A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics.

Text from CVE List

Affected versions 2

  • Eclipse KeyPont - GOSEaffected: 0.7.3 through 0.13.0-rc1CVE List
  • Eclipse KeyPont - GOSEaffected: all versions before 1.0.0-rc4CVE List

References 1