Eclipse Foundation Eclipse Keypont - Gose
7 CVEs affecting Eclipse Foundation Eclipse Keypont - Gose. Latest disclosed: 2026-10-23. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-89320 | | 2026-10-23 | `HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produ… | |
CVE-2026-89319 | | 2026-10-23 | `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated… | |
CVE-2026-89318 | | 2026-10-23 | `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **… | |
CVE-2026-89317 | | 2026-10-23 | gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical ext… | |
CVE-2026-89316 | | 2026-10-23 | `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a… | |
CVE-2026-89315 | | 2026-10-23 | `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.Str… | |
CVE-2026-89313 | | 2026-10-23 | `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not presen… |