CVE-2026-89319

Vulnerability Description

`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.

Related Weaknesses (CWE)

CWE-129

References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-4gj8-hg2r-gw6q

FAQ

What is CVE-2026-89319?

CVE-2026-89319 is a documented vulnerability. `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, a...

How severe is CVE-2026-89319?

CVSS scoring is not yet available for CVE-2026-89319. Check NVD for updates.

Is there a patch for CVE-2026-89319?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.