CVE-2026-89316 json
LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
published 2mo ago modified 9d ago also EUVD-2026-108648 , GHSA-fv39-8484-f4wr
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository eclipse-keypont/gose. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 6.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.
Patch / fix
- Eclipse Foundation Eclipse KeyPont - GOSE 1.0.0-rc4
Is CVE-2026-89316 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9d ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Eclipse Foundation Eclipse KeyPont - GOSE
Classification
- Weakness
-
- CWE-248 Uncaught Exception
References
-
github.com
/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr
exploit, advisory
Sources
- CVE List CVE-2026-89316
- NVD CVE-2026-89316
- Maintainer advisory GHSA-fv39-8484-f4wr
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of eclipse-keypont/gose published their own advisory on GitHub. Reviewed sources take precedence over it.