Eclipse JWE LoadPublicKey panics on nonEC alg with EC JWK
CVE-2026-89316 Published on October 23, 2026
LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` which RFC 7517 §4.4 permits reaches that assertion and **panics**.
Vulnerability Analysis
CVE-2026-89316 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Uncaught Exception
An exception is thrown from a function, but it is not caught. When an exception is not caught, it may cause the program to crash or expose sensitive information.
Affected Versions
Eclipse Foundation Eclipse KeyPont - GOSE:- Version 0.7.3, <= 0.13.0-rc1 is affected.
- Before 1.0.0-rc4 is affected.