CVE-2026-89316

The LoadPublicKey function is vulnerable to a panic due to an unchecked type assertion: algToOptsMap[alg].(*ECDSAOptions). This occurs when a JSON Web Key (JWK) contains a "kty" value of "EC" paired with a non-EC "alg" algorithm, a combination permitted by RFC 7517 §4.4 . The issue is associated ...