CVE-2026-89315

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

EUVD-2026-108647

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

CVE-2026-89315

"JwtClaims.MarshalJSON" built a Go struct at runtime with "reflect.StructOf", synthesising a field named ""A" + claimName" for each untyped claim. "reflect.StructOf" panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from...

Eclipse KeyPont - Improper GOSE exception handling vulnerability

Eclipse KeyPont – Versions 0.7.3 through 0.13.0-rc1 and versions prior to 1.0.0-rc4 contain an improper exception handling vulnerability. This vulnerability arises because JwtClaims.MarshalJSON uses reflect.StructOf during runtime to construct Go structs; it synthesizes type-free declarations for...