All vulnerabilities
CVE-2026-89319GHSA-4gj8-hg2r-gw6q

Eclipse KeyPont - GOSE: JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

Eclipse Foundation Eclipse KeyPont - GOSE
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.0.0-rc1Fixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

JweDirectDecryptorBlock.Decrypt read a 64-bit plaintext length from the _thales_aad protected-header field and used it without any validation. A truncated field panics binary.BigEndian.Uint64, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.

Text from CVE List

Affected versions 4

  • Eclipse KeyPont - GOSEaffected: 0.9.0 through 0.13.0-rc1CVE List
  • Eclipse KeyPont - GOSEaffected: all versions before 1.0.0-rc1CVE List
  • github.com/ThalesGroup/gose, go>= 0.9.0, <= 0.13.0-rc1GitHub
  • github.com/eclipse-keypont/gose, go< 1.0.0-rc1GitHub

References 1