CVE-2026-89316

The LoadPublicKey function is vulnerable to a panic due to an unchecked type assertion: algToOptsMap[alg].(*ECDSAOptions). This occurs when a JSON Web Key (JWK) contains a "kty" value of "EC" paired with a non-EC "alg" algorithm, a combination permitted by RFC 7517 §4.4 . The issue is associated ...

CVE-2026-89316 LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion

LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMapalg.ECDSAOptions. A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics...