JWE Initialization Vector Vulnerability in Eclipse Keypont Product
CVE-2026-89318

6.9MEDIUM

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Keypont - Gose
Vendor
CVE Published:
23 October 2026

What is CVE-2026-89318?

The implementation in the JweRsaKeyEncryptionDecryptorImpl component of Eclipse Keypont fails to validate the length of the JWE's initialization vector (IV) before passing it to the cipher.AEAD.Open method. This oversight leads to a situation where a JWE with an incorrectly sized IV can cause a panic in the Go standard library. Specifically, GCM nonce lengths that are not exactly the required size lead to a crash of the decrypting goroutine, effectively disrupting the decryption process and potentially exposing sensitive data to unauthorized access.

Affected Version(s)

Eclipse KeyPont - GOSE 0.8.0 <= 0.13.0-rc1

Eclipse KeyPont - GOSE 0 < 1.0.0-rc4

References

https://github.com/eclipse-keypont/gose/security/advisori...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eclipse Foundation Security Team
.