Public vulnerability disclosure

CVE-2026-89316

LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

publishedCWE-248

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.

Investigate in Cyber JSON Markdown

Technical severity6.3 mediumCVSS 4.0 · CNA: eclipse

Published2026-10-23Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

No remediation reported in collected sources.

Missing remediation information is not evidence that no patch exists.

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Eclipse KeyPont - GOSE Eclipse Foundation `github.com/ThalesGroup/gose`	≥ 0.7.3; ≤ 0.13.0-rc1 (affected, semver) Other versions: unaffected	CNA: eclipse
Eclipse KeyPont - GOSE Eclipse Foundation `github.com/eclipse-keypont/gose`	≥ 0; < 1.0.0-rc4 (affected, semver) Other versions: unaffected	CNA: eclipse

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
4.0 / 6.3 medium	`CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`	CNA: eclipse

Exploit evidence

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr
exploit · ADP: CISA-ADP

References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wrCNA: eclipse
https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wrADP: CISA-ADP · exploit