Eclipse KeyPont gose CVE-2026-89315

Exploitation requires that application code call json.Marshal on a *jose.JwtClaims value (typically the one returned by JwtVerifierImpl.Verify) - the panic lives only on the marshalling path, so callers that read claim fields directly are unaffected. The trigger is a token containing an untyped custom claim whose key either contains any character outside [A-Za-z0-9_] / Unicode letters-digits (e.g. '-', '.', ':', '/', space, '#', '@', as in the OIDC/Auth0-mandated 'https://example.com/roles') or collides after the 'A' prefix with an embedded field ('utomaticJwtClaims' → AutomaticJwtClaims, 'ettableJwtClaims' → SettableJwtClaims); the existing reserved-claim guard does not cover these. Limiting factors: impact is bounded to availability (VA:L) and only manifests as an outage if the caller does not recover the panic; applications that never serialise verified claims are not exposed. Notably no attacker is required - a legitimate standards-compliant IdP token triggers it.

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.9 Medium) whose only non-zero impact is VA:L - a recoverable availability (denial-of-service) hit with no confidentiality or integrity effect. No EPSS probability is supplied, there is no CISA KEV listing, and no standalone public exploit is packaged; however the GHSA advisory documents an executed reproducer covering both panic classes plus a regression test, so a working trigger demonstrably exists even though it is not published as a weaponised exploit. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency priority. The signals are coherent rather than conflicting: network-reachable (AV:N), low complexity (AC:L), unauthenticated (PR:N), but low technical impact (availability only, and only when the caller fails to recover the panic). The unusual elevating factor is that the crash fires on entirely legitimate tokens - URL-namespaced custom claims such as 'https://example.com/roles' are exactly what OIDC and Auth0 mandate - so the most probable first encounter is a self-inflicted production outage from a standards-compliant IdP, not a deliberate attack. Net: a genuine but moderate operational-reliability issue rather than a high-urgency breach risk; teams that marshal verified JwtClaims should patch this month, while those that never serialise the claims struct are not exposed.

A service uses eclipse-keypont/gose to verify JWTs and then calls json.Marshal on the *jose.JwtClaims returned by Verify - for logging, caching, forwarding or re-signing. When a token carries a custom claim whose name contains a character outside a Go identifier (e.g. the standard URL-namespaced 'https://example.com/roles') or the collision name 'utomaticJwtClaims', reflect.StructOf panics, the panic escapes encoding/json's recover, and the handling goroutine terminates. A researcher-executed reproducer in the advisory confirms both the invalid-identifier and duplicate-field panics; an attacker can trigger it with their own validly-issued token, but a trusted IdP issuing standards-compliant claims triggers it with no attacker at all.