CVE-2026-89316

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2026-89316

The LoadPublicKey function is vulnerable to a panic due to an unchecked type assertion: algToOptsMap[alg].(*ECDSAOptions). This occurs when a JSON Web Key (JWK) contains a "kty" value of "EC" paired with a non-EC "alg" algorithm, a combination permitted by RFC 7517 §4.4 . The issue is associated ...

EUVD-2026-108648

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

CVE-2026-89316

"LoadPublicKey" resolved an EC key's curve with an unchecked type assertion, "algToOptsMapalg.ECDSAOptions". A JWK declaring ""kty":"EC"" together with a non-EC ""alg"" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

PT-2026-121814

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...

Eclipse KeyPont - Improper GOSE exception handling vulnerability

Eclipse KeyPoint – Versions 0.7.3 through 0.13.0-rc1 and versions prior to 1.0.0-rc4 contain an improper exception handling vulnerability. This vulnerability arises because LoadPublicKey uses unchecked type casting to parse EC key curves; when JWK declares kty as EC but alg is non-EC, this castin...