Eclipse Keypont gose CVE-2026-89312

Exploitation requires a gose-backed decryptor that accepts attacker-submitted JWE tokens (e.g. via JweDirectDecryptorAeadImpl.Decrypt or a direct caller of AesGcmCryptor.Open). The attacker must supply a kid header matching a key already present in the decryptor's keystore (kids are normally public, appearing in every emitted JWE), set alg=dir with an enc matching that key, and encode an initialization vector whose decoded length is anything other than 12 bytes for AES-GCM. No key material, credentials, or prior valid message is needed - the nonce arrives directly from the wire. The principal LIMITING factor on impact (not on triggering) is the caller's panic posture: under net/http the panic is recovered per request and only that request fails, whereas a worker, daemon, or CLI that does not recover has its entire process terminated. A documented workaround is to validate that the decoded IV is exactly 12 bytes before handing the JWE to gose; recovering panics at the request boundary limits blast radius but does not fix the underlying defect, and the vendor states upgrading is the complete remediation.

This is a genuine but bounded denial-of-service issue (CWE-248, uncaught exception). The signals are internally consistent rather than conflicting: the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability with impact limited to availability of the vulnerable system only (VA:L; VC:N/VI:N/VA mapped low, VI/VC none), which matches the mechanism - the panic fires before any plaintext is produced, so confidentiality and integrity are untouched. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', consistent with a medium-severity DoS. No CISA KEV listing and no EPSS score were provided, so there is no evidence of active or at-scale exploitation; absence of these is not itself a signal of safety but does argue against emergency treatment. The score of 6.9 is driven almost entirely by easy remote reachability rather than impact depth, so raw severity overstates real-world priority for most deployments. The one caveat that raises risk: the advisory explicitly notes the A:L score assumes a net/http caller that recovers panics per request (effect = failed request); a worker, daemon, or CLI that does not recover will have the whole process terminated, which operators in that category should treat as more serious than the headline score suggests. Verify your own caller's panic-recovery posture before accepting the A:L framing.

An attacker who can submit a JWE to any service that decrypts using gose crafts a compact JWE whose initialization vector decodes to a length other than 12 bytes (e.g. 11 or 32 bytes), sets a kid matching a key in the decryptor's keystore (kids are typically public) and alg=dir with a matching enc. On the decryption path the wrong-sized nonce is forwarded unchecked to Go's crypto/cipher GCM Open, which panics, crashing the decrypting goroutine. A public proof-of-concept reproducer exists in the GHSA advisory and was executed to confirm the panic on nonce lengths 0, 1, 7, 11, 13 and 32; low attack complexity and no required credentials make this trivial to trigger.