# CVE-2026-89318: gose JweRsaKeyEncryptionDecryptorImpl panic on invalid IV length

Source: https://junglewise.ai/threats/cve-2026-89318-jwersakeyencryptiondecryptorimpl-decrypt-passed-the-jwe-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-89318 · Severity: info · Published 2026-10-23

The gose library, which handles JWE (JSON Web Encryption) decryption for Go applications, crashes when processing a malicious JWE message with an incorrectly sized initialization vector. An attacker who knows the recipient's public key can craft such a message to crash the application's decryption process, causing a denial of service without needing authentication or a valid prior message.

Technologies: [Eclipse KeyPont Gose](https://junglewise.ai/threats/technologies/eclipse-keypont-gose). Vendors: [Eclipse KeyPont](https://junglewise.ai/threats/vendors/eclipse-keypont).

## Quick answers

**Is CVE-2026-89318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89318 being exploited in the wild.

**How severe is CVE-2026-89318?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** Eclipse KeyPont Gose 0.8.0 through 1.0.0-rc3; Thales Group Gose 0.8.0 through 0.13.0-rc1.

**Is there a fix for CVE-2026-89318?** Yes: fixed in eclipse-keypont/gose v1.0.0-rc4 and later. Until then: Validate that the decoded initialization vector is exactly 12 bytes before passing a JWE to JweRsaKeyEncryptionDecryptorImpl.Decrypt. Additionally, recover panics at the request boundary to limit the blast radius; however, this does not address the underlying defect.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-09-01",
    "note": "Advisory published by Nicolas-Peiffer"
  },
  {
    "kind": "advisory",
    "at": "2026-10-23",
    "note": "CVE-2026-89318 published"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89318 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89318?** Check whether you run Eclipse KeyPont Gose or Thales Group Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in eclipse-keypont/gose v1.0.0-rc4 and later

Validate that the decoded initialization vector is exactly 12 bytes before passing a JWE to JweRsaKeyEncryptionDecryptorImpl.Decrypt. Additionally, recover panics at the request boundary to limit the blast radius; however, this does not address the underlying defect.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-09-01",
    "note": "Advisory published by Nicolas-Peiffer"
  },
  {
    "kind": "advisory",
    "at": "2026-10-23",
    "note": "CVE-2026-89318 published"
  }
]

## Technical details

The JweRsaKeyEncryptionDecryptorImpl.Decrypt function passes the JWE's initialization vector directly to Go's cipher.AEAD.Open without validating its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize() bytes (12 bytes), causing the decrypting goroutine to crash. The panic occurs after the content-encryption key is unwrapped but before authentication tag verification, allowing any holder of the recipient's public JWK to trigger it.

## Affected products

- Eclipse KeyPont gose 0.8.0 through 1.0.0-rc3
- Thales Group gose 0.8.0 through 0.13.0-rc1

## References

- [https://github.com/eclipse-keypont/gose/security/advisories/GHSA-265w-83cm-777q](https://github.com/eclipse-keypont/gose/security/advisories/GHSA-265w-83cm-777q)

## Related threats

- [Thales gose JweDirectDecryptorBlock unchecked length header](https://junglewise.ai/threats/cve-2026-89319-jwedirectdecryptorblock-decrypt-read-a-64-bit-plaintext-length)
- [gose JWS critical header bypass in JWT verification](https://junglewise.ai/threats/cve-2026-89317-gose-parsed-the-jws-crit-header-into-jwsheader-crit-and-then)
- [gose LoadPublicKey panic on kty/alg mismatch](https://junglewise.ai/threats/cve-2026-89316-loadpublickey-resolved-an-ec-key-s-curve-with-an-unchecked-type)
- [gose JwtClaims.MarshalJSON panic in reflect.StructOf](https://junglewise.ai/threats/cve-2026-89315-jwtclaims-marshaljson-built-a-go-struct-at-runtime-with-reflect)
- [Eclipse KeyPont gose quadratic time key_ops validation DoS](https://junglewise.ai/threats/cve-2026-89314-jwkfields-checkconsistency-detected-duplicate-key-ops-entries)