Unbounded Alloc & Slice-Bound Panic in JweDirectDecryptorBlock (Eclipse)
CVE-2026-89319 Published on October 23, 2026
JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.
Vulnerability Analysis
CVE-2026-89319 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-89319. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an out-of-bounds array index Vulnerability?
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CVE-2026-89319 has been classified to as an out-of-bounds array index vulnerability or weakness.
Affected Versions
Eclipse Foundation Eclipse KeyPont - GOSE:- Version 0.9.0, <= 0.13.0-rc1 is affected.
- Before 1.0.0-rc1 is affected.