Unchecked Type Assertion Vulnerability in Eclipse Keypont's GoSe Software
CVE-2026-89316

6.3MEDIUM

Key Information:

Vendor: Eclipse Foundation
Status: Eclipse Keypont - Gose
Vendor: CVE Published:; 23 October 2026

🔔 Create Eclipse Foundation Vulnerability Alert

What is CVE-2026-89316?

The GoSe software from Eclipse Keypont exhibits a vulnerability where the LoadPublicKey function improperly resolves an EC key's curve due to an unchecked type assertion. This flaw allows for a JWK with an 'EC' key type to be paired with a non-EC algorithm, which is permissible under RFC 7517 §4.4. This misconfiguration can lead to a runtime panic, disrupting the service and potentially exposing sensitive data.

Affected Version(s)

Eclipse KeyPont - GOSE 0.7.3 <= 0.13.0-rc1

Eclipse KeyPont - GOSE 0 < 1.0.0-rc4

References

https://github.com/eclipse-keypont/gose/security/advisori...

CVSS V4

Score:

6.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

High

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 23, 2026
Vulnerability Reserved
Sep 11, 2026

Credit

Eclipse Foundation Security Team

CVE-2026-89316 Data

JSON