Eclipse KeyPont GoSE EUVD-2026-108650

Exploitation requires only that the attacker possess the recipient's RSA public key, its kid, and the deployment's oaepHash - all of which are public parameters normally published in a JWKS; no secret, no prior valid message, and no authentication are needed, which is why the vector is effectively unauthenticated (PR:N). The specific trigger is a compact JWE whose base64url-decoded initialization-vector segment is any length other than 12 bytes, reaching cipher.AEAD.Open before the authentication tag is checked. The product must be at an affected version (>= v0.8.0 on eclipse-keypont/gose below v1.0.0-rc4, or any ThalesGroup/gose through v0.13.0-rc1) and must call JweRsaKeyEncryptionDecryptorImpl.Decrypt on externally supplied JWEs. The decisive limiting factor is the caller's panic posture: handlers running under net/http recover per request so impact is a single failed request, whereas a worker or daemon goroutine without its own recover() suffers process termination - this determines whether the flaw is a nuisance or a service outage.

This is a genuine but bounded-severity denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects that a remote actor needs only network reachability and no authentication secret - producing a valid EncryptedKey requires only the recipient's public JWK, kid, and oaepHash, all of which are public JOSE parameters. The only impact metric set is VA:L (availability, low); VC/VI/SC/SI/SA are all N, matching the advisory's statement that the panic fires before tag verification and plaintext production, so confidentiality and integrity are untouched. The 6.9 Medium score is therefore driven purely by a single-impact DoS, not a critical compromise. The vuln.today decision label is 'this_month' - not act_now or emergency - so this is a patch-in-routine-cycle item, not a drop-everything event. No KEV listing and no EPSS score are present in the input, so there is no evidence of active exploitation or a quantified exploitation probability; absence of these is not itself a risk signal. Crucially, real-world impact is caller-dependent: under net/http (which recovers per request) a single request fails, whereas a worker or daemon goroutine without its own recover() terminates the process. The advisory deliberately scored the milder case (A:L). Net: a real, cheaply-triggered, unauthenticated DoS in deployments that do not recover panics, but with a capped impact ceiling.

A service exposes a JWE-decryption endpoint using eclipse-keypont/gose and publishes its recipient public key in a JWKS. An attacker RSA-OAEP-wraps an arbitrary 32-byte CEK under that public key and submits a compact JWE whose initialization-vector segment decodes to a non-12-byte value; aead.Open then hits the Go stdlib GCM nonce-length check and panics. A confirmed, executed reproducer exists in the public GHSA advisory (panics on IV lengths 0 and 7, clean auth failure at 12 bytes), so publicly available exploit code exists; if the handler runs in a goroutine without recover(), the process terminates.