CVE-2026-89319: Thales gose JweDirectDecryptorBlock unchecked length header

CVE-2026-89319 · Severity: info · Published 2026-10-23

Thales gose is a cryptography library used for JSON Web Encryption (JWE) operations. The AES-CBC-HMAC decryption function fails to validate a 64-bit length field in the protected header, allowing an attacker who has seen one valid JWE to craft a malicious message that causes a denial-of-service panic or memory exhaustion without knowing the encryption key.

Technologies: Eclipse KeyPont Gose, Thales Gose. Vendors: Eclipse KeyPont, Thales.

Quick answers

Is CVE-2026-89319 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89319 being exploited in the wild.
How severe is CVE-2026-89319?
Informational severity, published 23 October 2026.
Which products and versions are affected?
Eclipse KeyPont Gose before 1.0.0-rc1; Thales Gose 0.9.0 through 0.13.0-rc1.
Is there a fix for CVE-2026-89319?
Yes: fixed in Thales gose 1.0.0-rc1 (eclipse-keypont/gose: any version 1.0.0-rc1 or later). Until then: Upgrade to the patched version. Prior to upgrading, applications should be aware that observed valid JWEs can be reused with forged _thales_aad headers to trigger denial of service. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89319 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-89319?
Check whether you run Eclipse KeyPont Gose or Thales Gose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Thales gose 1.0.0-rc1 (eclipse-keypont/gose: any version 1.0.0-rc1 or later)

Upgrade to the patched version. Prior to upgrading, applications should be aware that observed valid JWEs can be reused with forged _thales_aad headers to trigger denial of service.

Technical details

JweDirectDecryptorBlock.Decrypt reads an unvalidated 64-bit plaintext length from the _thales_aad protected-header field after the HMAC integrity check. Three failure modes result: a nil header causes a nil pointer dereference, a truncated field panics in binary.BigEndian.Uint64, and an oversized length triggers unbounded allocation or slice-bounds panic. Although the HMAC check ordinarily gates this, a related vulnerability (GHSA-h6w5-722x-2h3m) breaks authentication in all affected releases, allowing reuse of any observed tag on forged content.

Affected products

  • Thales gose 0.9.0 through 0.13.0-rc1
  • Eclipse Keypont gose before 1.0.0-rc1

Timeline

  • 2024-08-02: other: Vulnerability introduced in commit b7b140e, adding AES-CBC-then-HMAC support
  • 2026-09-01: disclosed: GHSA-4gj8-hg2r-gw6q advisory published
  • 2026-10-23: advisory: CVE-2026-89319 published on NVD
  • 2026: patched: Fixed in commit 3d1b063 (released as v1.0.0-rc1)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.