CVE-2026-89315

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

CVE-2026-89315 JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

EUVD-2026-108647

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

CVE-2026-89315 JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

CVE-2026-89315

"JwtClaims.MarshalJSON" built a Go struct at runtime with "reflect.StructOf", synthesising a field named ""A" + claimName" for each untyped claim. "reflect.StructOf" panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from...

CVE-2026-89315 JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...

CVE-2026-89315

The JwtClaims.MarshalJSON function is vulnerable to a panic due to the use of reflect.StructOf at runtime. The application synthesizes field names by prepending "A" to untyped claim names; if these resulting names are not valid Go identifiers or result in duplicate fields, the program will crash....

PT-2026-121813

JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT...