Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89319— JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation

Quick assessment

Affected
Eclipse Foundation Eclipse KeyPont - GOSE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

方法从受保护头字段 中读取了一个 64 位的明文长度值，但未对其进行任何验证。若该字段被截断，将导致 函数触发 panic；若该值过大，则会导致无限制的内存分配；若该值大于解密后的数据块长度，则会因切片越界错误而触发 panic。

CVSS 6.3 · Medium EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse KeyPont - GOSE 0.9.0≤ 0.13.0-rc1 affected
< 1.0.0-rc1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89319

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
Source: CVE Program / CVE List V5
Vulnerability Description
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数组索引的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse KeyPont - GOSE 0.9.0 ~ 0.13.0-rc1 -
Eclipse Foundation Eclipse KeyPont - GOSE 0 ~ 1.0.0-rc1 -

II. Public POCs for CVE-2026-89319

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89319

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-89319 (1)

Same Patch Batch · Eclipse Foundation · 2026-10-23 · 9 CVEs total

CVE-2026-89320 8.8 HIGH HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, v
CVE-2026-89312 6.9 MEDIUM AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length che
CVE-2026-89318 6.9 MEDIUM JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.O
CVE-2026-89314 6.9 MEDIUM Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
CVE-2026-89315 6.9 MEDIUM JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a vali
CVE-2026-89313 6.3 MEDIUM JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is a
CVE-2026-89316 6.3 MEDIUM LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOp
CVE-2026-89317 6.3 MEDIUM JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)

IV. Related Vulnerabilities

Same product: Eclipse KeyPont - GOSE
Same vendor: Eclipse Foundation
Same weakness: CWE-129

V. Comments for CVE-2026-89319

No comments yet

Leave a comment