Eclipse KeyPont - GOSE — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in Eclipse KeyPont - GOSE, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-89320	HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity CWE-354	8.8	High	2026-10-23
CVE-2026-89319	JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation CWE-129	6.3	Medium	2026-10-23
CVE-2026-89318	JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) CWE-248	6.9	Medium	2026-10-23
CVE-2026-89317	JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) CWE-20	6.3	Medium	2026-10-23
CVE-2026-89316	LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion CWE-248	6.3	Medium	2026-10-23
CVE-2026-89315	JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix CWE-248	6.9	Medium	2026-10-23
CVE-2026-89314	Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s CWE-407	6.9	Medium	2026-10-23
CVE-2026-89313	JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil CWE-706	6.3	Medium	2026-10-23
CVE-2026-89312	AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV CWE-248	6.9	Medium	2026-10-23

All 9 known CVE vulnerabilities affecting Eclipse KeyPont - GOSE with full Chinese analysis, references, and POCs where available.