Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-89316

LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0.7.3 to ≤ 0.13.0-rc1affected

Eclipse Foundation Eclipse KeyPont - GOSE

Default version status: unaffected

  • 0 to < 1.0.0-rc4affected

References