Quick answers
- Is CVE-2026-89314 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-89314 being exploited in the wild.
- How severe is CVE-2026-89314?
- Informational severity, published 23 October 2026.
- Which products and versions are affected?
- Eclipse KeyPont Gose < 1.0.0-rc4; Thalesgroup Gose >= 0.7.3, <= 0.13.0-rc1.
- Is there a fix for CVE-2026-89314?
- Yes: fixed in eclipse-keypont/gose v1.0.0-rc4 or later. Until then: Fetch JWKS documents only from trusted, pinned endpoints and impose a size limit on the response body before handing it to gose. Additionally, consider implementing per-request timeouts on JWKS validation operations.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-01", "note": "GHSA-r56w-f43c-828p published" }, { "kind": "advisory", "at": "2026-10-23", "note": "CVE-2026-89314 published" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-89314 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-89314?
- Check whether you run Eclipse KeyPont Gose or Thalesgroup Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: eclipse-keypont/gose v1.0.0-rc4 or later
Fetch JWKS documents only from trusted, pinned endpoints and impose a size limit on the response body before handing it to gose. Additionally, consider implementing per-request timeouts on JWKS validation operations.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-09-01", "note": "GHSA-r56w-f43c-828p published" }, { "kind": "advisory", "at": "2026-10-23", "note": "CVE-2026-89314 published" } ]
Technical details
The jwkFields.CheckConsistency function uses a pairwise nested loop to detect duplicate key_ops entries, resulting in O(n²) validation cost. An attacker provides a JWKS with thousands of distinct but invalid key_ops entries (under 1 MB total size) to exhaust CPU. The vulnerability requires the consumer to fetch JWKS from an attacker-controlled or misconfigured endpoint; it is not remotely exploitable against correctly configured deployments using a trusted identity provider.
Affected products
- ThalesGroup gose >= 0.7.3, <= 0.13.0-rc1
- Eclipse KeyPont gose < 1.0.0-rc4