Input Validation Flaw in JweDirectDecryptorBlock Affects Eclipse KeyPont

CVE-2026-89319

What is CVE-2026-89319?

An input validation flaw in the JweDirectDecryptorBlock's decryption process allows the reading of an unvalidated 64-bit plaintext length from a protected-header field. This issue may lead to panic conditions in the application if the field is truncated, resulting in errors during binary conversion and causing unsafe memory allocations. Furthermore, oversized values can trigger additional errors, compromising the overall stability and security of the application.

References