Eclipse Keypont Gose
Approved changes feed: RSS · Atom
cpe:2.3:a:eclipse_foundation:eclipse_keypont_-_gose:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Eclipse Foundation (2c315c48-0111-5572-bbde-cc70cfafb2e9) |
|---|---|
| Product | Eclipse Keypont Gose (c1b9e6eb-6971-5a17-a89b-87feaca23db4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-89316 |
vulnerable | 2026-11-03 10:17:50.692203 |
LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.
Published: 2026-10-23T08:48:08.682Z
Updated: 2026-11-02T13:16:12.850Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89312 |
vulnerable | 2026-11-03 10:17:50.599563 |
AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV
`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
Published: 2026-10-23T08:36:53.971Z
Updated: 2026-11-02T12:46:35.266Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89317 |
vulnerable | 2026-11-03 10:17:50.393004 |
JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
Published: 2026-10-23T08:50:22.987Z
Updated: 2026-11-02T13:17:29.417Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89313 |
vulnerable | 2026-11-03 10:17:50.373742 |
JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
`JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS document together with a `nil` error — a confidently wrong answer instead of "not found".
Published: 2026-10-23T08:40:55.499Z
Updated: 2026-11-02T12:49:31.095Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89319 |
vulnerable | 2026-11-03 10:17:50.280482 |
JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
Published: 2026-10-23T08:54:37.681Z
Updated: 2026-11-02T13:22:22.590Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89315 |
vulnerable | 2026-11-03 10:17:50.253068 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89320 |
vulnerable | 2026-11-03 10:17:50.217185 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89314 |
vulnerable | 2026-11-03 10:17:50.193494 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89318 |
vulnerable | 2026-11-03 10:17:50.060058 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.