Advisories · Technology
Eclipse Foundation Eclipse KeyPont - GOSE.
Every CVE that names Eclipse Foundation Eclipse KeyPont - GOSE among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.8 High
HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-354
- CVSS 6.3 Medium
JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-129
- CVSS 6.9 Medium
JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-248
- CVSS 6.3 Medium
JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11)
- Eclipse Foundation Eclipse KeyPont - GOSE
- Weak cryptography or TLS
- CWE-20
- CVSS 6.3 Medium
LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-248
- CVSS 6.9 Medium
JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-248
- CVSS 6.9 Medium
Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s
- Eclipse Foundation Eclipse KeyPont - GOSE
- Denial of service
- CVSS 6.3 Medium
JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-706
- CVSS 6.9 Medium
AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV
- Eclipse Foundation Eclipse KeyPont - GOSE
- CWE-248