CVE-2026-89319 Details
Description
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
A vulnerability exists in the JWE Direct Decryptor Block component of the Eclipse KeyPont library, specifically in versions 0.9.0 through 0.13.0-rc1. The issue arises because the decryption function reads a 64-bit length value from the '_thales_aad' protected-header field without proper validation. This oversight can lead to several failure modes: a nil pointer dereference if the header is missing, a panic due to a slice being too short for the expected length, unbounded memory allocation for oversized values, and a slice-bounds error when the declared length exceeds the actual decrypted data. The vulnerability is exploitable by sending a crafted JWE that bypasses the integrity check, allowing manipulation of the '_thales_aad' header to trigger these errors.
Users can upgrade to Eclipse KeyPont version 1.0.0-rc1 or later, where this vulnerability has been fixed. For those using the ThalesGroup version of the library, a module path change to 'github.com/eclipse-keypont/gose' is required, as no patched release is available under the original module.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-keypont/gose/security/advisories/GHSA-4gj8-hg2r-gw6q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/eclipse-keypont/gose/security/advisories/GHSA-4gj8-hg2r-gw6q | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-129 | Improper Validation of Array Index | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse KeyPont gose | < 1.0.0-rc1 (semver) |
CPE
Remediation
| |
| ThalesGroup gose | >= 0.9.0, <= 0.13.0-rc1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |