CVE-2026-89316

Published: Ott 23, 2026 Last Modified: Ott 23, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `'kty':'EC'` together with a non-EC `'alg'` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.

248

Uncaught Exception

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart Read Application Data
Applicable Platforms
Languages: C++, Java, C#
View CWE Details
https://github.com/eclipse-keypont/gose/security/advisories…
https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr