CVE-2026-89315: gose JwtClaims.MarshalJSON panic in reflect.StructOf

CVE-2026-89315 · Severity: info · Published 2026-10-23

A Go library for JWT (JSON Web Token) handling can crash when processing legitimate tokens with standard custom claim names. When marshaling JWT claims to JSON—a common operation for logging, caching, or re-signing tokens—the library panics on claims with names like URL-based identifiers (e.g., https://example.com/roles) that are valid in the JWT standard. This causes service disruption even when tokens come from trusted identity providers, not just from attackers.

Technologies: Eclipse KeyPont Gose, Thalesgroup Gose. Vendors: Eclipse KeyPont, Thalesgroup.

Quick answers

Is CVE-2026-89315 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89315 being exploited in the wild.
How severe is CVE-2026-89315?
Informational severity, published 23 October 2026.
Which products and versions are affected?
Eclipse KeyPont Gose before 1.0.0-rc4; Thalesgroup Gose 0.7.3 to 0.13.0-rc1.
Is there a fix for CVE-2026-89315?
Yes: fixed in eclipse-keypont/gose v1.0.0-rc4 and later; ThalesGroup/gose has no fix (module discontinued). Until then: Avoid calling json.Marshal on *jose.JwtClaims returned from Verify; instead read claim fields directly or copy UntypedClaims into a separate map before marshaling. Consumers on ThalesGroup/gose must migrate to the eclipse-keypont fork by changing the module path in go.mod. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89315 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-89315?
Check whether you run Eclipse KeyPont Gose or Thalesgroup Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: eclipse-keypont/gose v1.0.0-rc4 and later; ThalesGroup/gose has no fix (module discontinued)

Avoid calling json.Marshal on *jose.JwtClaims returned from Verify; instead read claim fields directly or copy UntypedClaims into a separate map before marshaling. Consumers on ThalesGroup/gose must migrate to the eclipse-keypont fork by changing the module path in go.mod.

Technical details

JwtClaims.MarshalJSON dynamically constructs a Go struct at runtime using reflect.StructOf, prefixing each untyped claim name with "A" to create field names. This fails when claim names contain characters outside the valid Go identifier set (hyphens, dots, colons, slashes, etc.) or when the prefixed name collides with reserved fields like "AutomaticJwtClaims". The panic in reflect.StructOf escapes encoding/json's error recovery, propagating to the caller and terminating the goroutine. The fix replaces runtime struct construction with direct map marshaling, eliminating the naming constraint.

Affected products

  • ThalesGroup gose 0.7.3 to 0.13.0-rc1
  • eclipse-keypont gose before 1.0.0-rc4

Timeline

  • 2026-09-01: disclosed: GHSA-hwm6-rwv6-xgq8 published
  • 2026-10-23: advisory: CVE-2026-89315 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.