CVE-2026-89312: gose AesGcmCryptor.Open nonce validation denial of service

CVE-2026-89312 · Severity: info · Published 2026-10-23

The gose library, used for JWE (JSON Web Encryption) decryption, fails to validate the nonce (initialization vector) length before passing it to Go's cryptographic functions. An attacker can send a JWE message with an incorrectly-sized nonce, causing the decryption process to crash with a panic. Depending on how the application handles panics, this could result in a denial-of-service condition affecting individual requests or entire processes.

Technologies: Eclipse KeyPont Gose, Thales Gose. Vendors: Eclipse KeyPont, Thales.

Quick answers

Is CVE-2026-89312 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89312 being exploited in the wild.
How severe is CVE-2026-89312?
Informational severity, published 23 October 2026.
Which products and versions are affected?
Eclipse KeyPont Gose <1.0.0-rc4; Thales Gose >=0.7.3, <=0.13.0-rc1.
Is there a fix for CVE-2026-89312?
Yes: fixed in eclipse-keypont/gose v1.0.0-rc4 or later; ThalesGroup/gose users must migrate to eclipse-keypont/gose. Until then: Validate the initialization vector (IV) length before passing a JWE to gose, rejecting any message whose decoded IV is not exactly 12 bytes for AES-GCM algorithms. Additionally, recover panics at the request boundary to limit denial-of-service scope, though this does not address the underlying defect. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89312 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-89312?
Check whether you run Eclipse KeyPont Gose or Thales Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: eclipse-keypont/gose v1.0.0-rc4 or later; ThalesGroup/gose users must migrate to eclipse-keypont/gose

Validate the initialization vector (IV) length before passing a JWE to gose, rejecting any message whose decoded IV is not exactly 12 bytes for AES-GCM algorithms. Additionally, recover panics at the request boundary to limit denial-of-service scope, though this does not address the underlying defect.

Technical details

AesGcmCryptor.Open passes an attacker-supplied nonce directly to cipher.AEAD.Open without validating its length, triggering a panic in the Go standard library when the nonce is not exactly NonceSize() bytes (12 bytes for AES-GCM). The asymmetric Seal method correctly validates nonce length but Open does not, despite handling untrusted wire input. An attacker with no authentication or credentials can submit a malformed JWE to trigger denial of service.

Affected products

  • Thales gose >=0.7.3, <=0.13.0-rc1
  • Eclipse KeyPont gose <1.0.0-rc4

Timeline

  • 2026-09-01: disclosed: GHSA advisory published
  • 2026-10-23: advisory: CVE-2026-89312 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.