Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-89315

JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0.7.3 to ≤ 0.13.0-rc1affected

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0 to < 1.0.0-rc4affected

References