# CVE-2026-89312: gose AesGcmCryptor.Open nonce validation denial of service

Source: https://junglewise.ai/threats/cve-2026-89312-aesgcmcryptor-open-passed-a-caller-supplied-nonce-straight-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-89312 · Severity: info · Published 2026-10-23

The gose library, used for JWE (JSON Web Encryption) decryption, fails to validate the nonce (initialization vector) length before passing it to Go's cryptographic functions. An attacker can send a JWE message with an incorrectly-sized nonce, causing the decryption process to crash with a panic. Depending on how the application handles panics, this could result in a denial-of-service condition affecting individual requests or entire processes.

Technologies: [Eclipse KeyPont Gose](https://junglewise.ai/threats/technologies/eclipse-keypont-gose), [Thales Gose](https://junglewise.ai/threats/technologies/gose). Vendors: [Eclipse KeyPont](https://junglewise.ai/threats/vendors/eclipse-keypont), [Thales](https://junglewise.ai/threats/vendors/thales).

## Quick answers

**Is CVE-2026-89312 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89312 being exploited in the wild.

**How severe is CVE-2026-89312?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Eclipse KeyPont Gose <1.0.0-rc4; Thales Gose >=0.7.3, <=0.13.0-rc1.

**Is there a fix for CVE-2026-89312?** Yes: fixed in eclipse-keypont/gose v1.0.0-rc4 or later; ThalesGroup/gose users must migrate to eclipse-keypont/gose. Until then: Validate the initialization vector (IV) length before passing a JWE to gose, rejecting any message whose decoded IV is not exactly 12 bytes for AES-GCM algorithms. Additionally, recover panics at the request boundary to limit denial-of-service scope, though this does not address the underlying defect. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89312 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89312?** Check whether you run Eclipse KeyPont Gose or Thales Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in eclipse-keypont/gose v1.0.0-rc4 or later; ThalesGroup/gose users must migrate to eclipse-keypont/gose

Validate the initialization vector (IV) length before passing a JWE to gose, rejecting any message whose decoded IV is not exactly 12 bytes for AES-GCM algorithms. Additionally, recover panics at the request boundary to limit denial-of-service scope, though this does not address the underlying defect.

## Technical details

AesGcmCryptor.Open passes an attacker-supplied nonce directly to cipher.AEAD.Open without validating its length, triggering a panic in the Go standard library when the nonce is not exactly NonceSize() bytes (12 bytes for AES-GCM). The asymmetric Seal method correctly validates nonce length but Open does not, despite handling untrusted wire input. An attacker with no authentication or credentials can submit a malformed JWE to trigger denial of service.

## Affected products

- Thales gose >=0.7.3, <=0.13.0-rc1
- Eclipse KeyPont gose <1.0.0-rc4

## Timeline

- 2026-09-01: disclosed: GHSA advisory published
- 2026-10-23: advisory: CVE-2026-89312 published on NVD

## References

- [https://github.com/eclipse-keypont/gose/security/advisories/GHSA-xx6h-2jgg-93m2](https://github.com/eclipse-keypont/gose/security/advisories/GHSA-xx6h-2jgg-93m2)

## Related threats

- [Thales gose JweDirectDecryptorBlock unchecked length header](https://junglewise.ai/threats/cve-2026-89319-jwedirectdecryptorblock-decrypt-read-a-64-bit-plaintext-length)
- [gose JweRsaKeyEncryptionDecryptorImpl panic on invalid IV length](https://junglewise.ai/threats/cve-2026-89318-jwersakeyencryptiondecryptorimpl-decrypt-passed-the-jwe-s)
- [gose JWS critical header bypass in JWT verification](https://junglewise.ai/threats/cve-2026-89317-gose-parsed-the-jws-crit-header-into-jwsheader-crit-and-then)
- [gose JwtClaims.MarshalJSON panic in reflect.StructOf](https://junglewise.ai/threats/cve-2026-89315-jwtclaims-marshaljson-built-a-go-struct-at-runtime-with-reflect)
- [Eclipse KeyPont gose quadratic time key_ops validation DoS](https://junglewise.ai/threats/cve-2026-89314-jwkfields-checkconsistency-detected-duplicate-key-ops-entries)