Eclipse Keypont Gose
Monthly
The AES-CBC-with-HMAC JWE path in Eclipse KeyPont gose (published as github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1) provides no ciphertext integrity at all: HmacShaCryptor.Hash returned the MAC of the empty message for every input, so the authentication tag is constant per key and independent of the message. An unauthenticated remote attacker who has observed a single legitimately produced JWE under the target key can replay that tag onto arbitrary attacker-chosen header, IV and ciphertext and pass verification, enabling bit-flipping manipulation of the recovered plaintext and padding-oracle-style attacks; confidentiality alone is not broken. Only the CBC-HMAC direct encryption/decryption blocks are affected, AEAD/GCM modes do not use this cryptor, and the evaluator rates it AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N with no public exploit identified at time of analysis.
Denial of service in Eclipse KeyPont Gose affects the AES-CBC-HMAC direct decryption path (NewJweDirectDecryptorBlock) in Go module github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1: an unvalidated 64-bit plaintext length from the _thales_aad protected header causes a nil dereference, a BigEndian.Uint64 panic on short input, an unbounded allocation, or a slice-bounds panic after the HMAC check. The advisory includes an executed reproducer and notes that the same 11 releases carry GHSA-h6w5-722x-2h3m, whose constant, message-independent HMAC tag lets an attacker who has seen one valid JWE reuse its tag so the length field is reachable without the MAC key; confidentiality and integrity are unaffected. Active exploitation is not confirmed (no CISA KEV data is provided), the advisory contains an executed reproducer for the panic and oversized-length behavior, and the vuln.today priority is this_month.
Eclipse KeyPont GoSE's JWE decryptor panics instead of returning an error when a compact JWE carries an incorrectly sized initialization vector, giving a denial of service to anyone holding the recipient's public key. The flaw affects github.com/eclipse-keypont/gose releases from v0.8.0 up to but excluding v1.0.0-rc4, and the deprecated github.com/ThalesGroup/gose module through v0.13.0-rc1. A public PoC reference and a working reproducer are documented in the upstream advisory; it is not confirmed as actively exploited (no KEV entry), and the practical impact ranges from a single failed HTTP request to full process termination depending on the caller's panic recovery posture.
Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) fails to enforce the JWS `crit` header: any token carrying a non-empty `crit` array should be rejected per RFC 7515 §4.1.11 because gose implements no header extensions, yet affected verifiers accept such tokens and report successful verification. Because `crit` lives inside the signed protected header, this is not reachable by an unauthenticated attacker without the signing key; the realistic risk is cross-context replay, where a trusted issuer constrains a token's use with a critical extension (RFC 7797 `b64:false`, RFC 7800 `cnf`, or an ecosystem `must-revoke-check`) and a gose-backed verifier silently drops that mandatory constraint. Signatures and claims remain authentic, so integrity impact is limited; no public exploit code is identified at time of analysis and the issue is not in CISA KEV. Fixed in eclipse-keypont/gose v1.0.0-rc4 (commit be2277b, merged as 692c25c); the legacy ThalesGroup module path ends at v0.13.0-rc1 and remains vulnerable.
Denial of service in Eclipse KeyPont gose occurs when a JWK declares kty EC with a non-EC alg and is passed directly to the exported LoadPublicKey or LoadPrivateKey loader; an unchecked ECDSAOptions type assertion panics the process. Affected releases are github.com/eclipse-keypont/gose before 1.0.0-rc4 and the deprecated github.com/ThalesGroup/gose path through 0.13.0-rc1, while gose's own NewVerificationKey/JWKS path gates EC algorithms and is not vulnerable. Exploitation is conditional on a consuming application forwarding externally supplied JWKs to those loaders; no CISA KEV listing or verified public exploit code is indicated, the advisory includes a reproducer, and the vendor rates the issue CVSS 4.0 6.3 with high attack complexity and availability-only impact.
Denial of service in Eclipse KeyPont's `gose` JOSE/JWT Go library: `JwtClaims.MarshalJSON` builds a runtime struct with `reflect.StructOf`, naming each field `"A" + claimName`, which panics whenever an untyped claim key is not a valid Go identifier (for example the URL-namespaced `https://example.com/roles` claims that OIDC and Auth0 mandate) or collides after prefixing (`utomaticJwtClaims`, `ettableJwtClaims`). All releases of `github.com/ThalesGroup/gose` from v0.7.3 through v0.13.0-rc1 are affected and that module path is deprecated and unpatched, while `github.com/eclipse-keypont/gose` is affected below v1.0.0-rc4 and fixed in v1.0.0-rc4. Impact is availability only (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, vendor CVSS 4.0 6.9 Medium with VA:L), the panic is reachable from legitimate standards-compliant IdP tokens without any attacker, and it only bites callers that call `json.Marshal` on the `*jose.JwtClaims` returned by `JwtVerifierImpl.Verify` without recovering; a reproducer is documented in the upstream advisory, and no public exploit code or active exploitation is confirmed (no CISA KEV listing).
CPU exhaustion in the Go JOSE library Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) allows a hostile JWK/JWKS document to pin one CPU core for roughly 15 seconds, because the duplicate key_ops validation in jwkFields.CheckConsistency runs an all-pairs nested loop whose cost grows with the square of the entry count (CWE-407). Because that check executes on every JWK and JWKS unmarshal, any consumer that parses a JWKS body from an attacker-controlled or attacker-influenced source - a compromised or malicious identity provider, a misconfigured discovery URL, or an application that accepts a JWKS URL as user input - is exposed; the authoritative assessment rates the impact as availability-only (CVSS:3.1 AV:N/AC:H, no confidentiality or integrity effect), with the higher AC reflecting the precondition that the victim must actually fetch from the hostile endpoint rather than any attacker-uncontrolled timing condition, and notes a trusted, pinned IdP deployment is not triggerable. All releases since the earliest tag are affected on the ThalesGroup module path (>= 0.7.3, <= 0.13.0-rc1, which is deprecated and unpatched) and on the Eclipse path (< 1.0.0-rc4), with the fix first shipped in v1.0.0-rc4; there is no CISA KEV listing and no public exploit identified at time of analysis.
JwksTrustStore.Get in the Eclipse KeyPont gose JOSE library (formerly github.com/ThalesGroup/gose) can return the last key parsed from a JWKS document, with a nil error, when the caller asks for a kid that is not present in that document - so absent-key lookups silently succeed against the wrong key instead of failing as 'not found'. The flaw exists in every release from v0.7.5 through v1.0.0-rc3 of the eclipse-keypont module path, and in the deprecated ThalesGroup path up to its final tag v0.13.0-rc1; it is fixed in v1.0.0-rc4. It is not an authentication bypass: JwtVerifierImpl.Verify still enforces algorithm match and signature verification against whatever key it receives, so a token signed by an unrelated key is still rejected; the realistic impact is broken kid-to-key binding during key rotation and any downstream logic that treats kid as a trusted decision input, which is why the maintainers rate integrity impact Low with High attack complexity. There is no KEV listing and no public exploit code identified at time of analysis; the upstream advisory publishes a reproducer that demonstrates the wrong-key return against an httptest JWKS server, and the recommended handling is to fold the fix into a routine monthly patch cycle rather than an emergency response.
Denial of service in the Eclipse Keypont gose Go JWE library (published historically as github.com/ThalesGroup/gose) where AesGcmCryptor.Open forwards a caller-supplied, wire-derived nonce to crypto/cipher AEAD Open without a length check, causing the Go standard library to panic instead of returning an error. Any party able to submit a compact JWE to a gose-backed decryptor can trigger it without key material or credentials (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - they only need a kid matching a key in the decryptor's keystore, alg=dir with a matching enc, and an IV whose decoded length is anything other than 12 bytes. Impact is bounded by the caller's panic posture: under net/http the panic is recovered per request and only that request fails, while a worker, daemon or CLI without recovery has its process terminated; confidentiality and integrity are unaffected because the panic occurs before plaintext is produced. No public exploit code was identified at time of analysis, although the advisory ships a unit-test reproducer that demonstrates the panic; this_month priority, not KEV-listed.
The AES-CBC-with-HMAC JWE path in Eclipse KeyPont gose (published as github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1) provides no ciphertext integrity at all: HmacShaCryptor.Hash returned the MAC of the empty message for every input, so the authentication tag is constant per key and independent of the message. An unauthenticated remote attacker who has observed a single legitimately produced JWE under the target key can replay that tag onto arbitrary attacker-chosen header, IV and ciphertext and pass verification, enabling bit-flipping manipulation of the recovered plaintext and padding-oracle-style attacks; confidentiality alone is not broken. Only the CBC-HMAC direct encryption/decryption blocks are affected, AEAD/GCM modes do not use this cryptor, and the evaluator rates it AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N with no public exploit identified at time of analysis.
Denial of service in Eclipse KeyPont Gose affects the AES-CBC-HMAC direct decryption path (NewJweDirectDecryptorBlock) in Go module github.com/ThalesGroup/gose v0.9.0 through v0.13.0-rc1: an unvalidated 64-bit plaintext length from the _thales_aad protected header causes a nil dereference, a BigEndian.Uint64 panic on short input, an unbounded allocation, or a slice-bounds panic after the HMAC check. The advisory includes an executed reproducer and notes that the same 11 releases carry GHSA-h6w5-722x-2h3m, whose constant, message-independent HMAC tag lets an attacker who has seen one valid JWE reuse its tag so the length field is reachable without the MAC key; confidentiality and integrity are unaffected. Active exploitation is not confirmed (no CISA KEV data is provided), the advisory contains an executed reproducer for the panic and oversized-length behavior, and the vuln.today priority is this_month.
Eclipse KeyPont GoSE's JWE decryptor panics instead of returning an error when a compact JWE carries an incorrectly sized initialization vector, giving a denial of service to anyone holding the recipient's public key. The flaw affects github.com/eclipse-keypont/gose releases from v0.8.0 up to but excluding v1.0.0-rc4, and the deprecated github.com/ThalesGroup/gose module through v0.13.0-rc1. A public PoC reference and a working reproducer are documented in the upstream advisory; it is not confirmed as actively exploited (no KEV entry), and the practical impact ranges from a single failed HTTP request to full process termination depending on the caller's panic recovery posture.
Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) fails to enforce the JWS `crit` header: any token carrying a non-empty `crit` array should be rejected per RFC 7515 §4.1.11 because gose implements no header extensions, yet affected verifiers accept such tokens and report successful verification. Because `crit` lives inside the signed protected header, this is not reachable by an unauthenticated attacker without the signing key; the realistic risk is cross-context replay, where a trusted issuer constrains a token's use with a critical extension (RFC 7797 `b64:false`, RFC 7800 `cnf`, or an ecosystem `must-revoke-check`) and a gose-backed verifier silently drops that mandatory constraint. Signatures and claims remain authentic, so integrity impact is limited; no public exploit code is identified at time of analysis and the issue is not in CISA KEV. Fixed in eclipse-keypont/gose v1.0.0-rc4 (commit be2277b, merged as 692c25c); the legacy ThalesGroup module path ends at v0.13.0-rc1 and remains vulnerable.
Denial of service in Eclipse KeyPont gose occurs when a JWK declares kty EC with a non-EC alg and is passed directly to the exported LoadPublicKey or LoadPrivateKey loader; an unchecked ECDSAOptions type assertion panics the process. Affected releases are github.com/eclipse-keypont/gose before 1.0.0-rc4 and the deprecated github.com/ThalesGroup/gose path through 0.13.0-rc1, while gose's own NewVerificationKey/JWKS path gates EC algorithms and is not vulnerable. Exploitation is conditional on a consuming application forwarding externally supplied JWKs to those loaders; no CISA KEV listing or verified public exploit code is indicated, the advisory includes a reproducer, and the vendor rates the issue CVSS 4.0 6.3 with high attack complexity and availability-only impact.
Denial of service in Eclipse KeyPont's `gose` JOSE/JWT Go library: `JwtClaims.MarshalJSON` builds a runtime struct with `reflect.StructOf`, naming each field `"A" + claimName`, which panics whenever an untyped claim key is not a valid Go identifier (for example the URL-namespaced `https://example.com/roles` claims that OIDC and Auth0 mandate) or collides after prefixing (`utomaticJwtClaims`, `ettableJwtClaims`). All releases of `github.com/ThalesGroup/gose` from v0.7.3 through v0.13.0-rc1 are affected and that module path is deprecated and unpatched, while `github.com/eclipse-keypont/gose` is affected below v1.0.0-rc4 and fixed in v1.0.0-rc4. Impact is availability only (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, vendor CVSS 4.0 6.9 Medium with VA:L), the panic is reachable from legitimate standards-compliant IdP tokens without any attacker, and it only bites callers that call `json.Marshal` on the `*jose.JwtClaims` returned by `JwtVerifierImpl.Verify` without recovering; a reproducer is documented in the upstream advisory, and no public exploit code or active exploitation is confirmed (no CISA KEV listing).
CPU exhaustion in the Go JOSE library Eclipse KeyPont gose (formerly github.com/ThalesGroup/gose) allows a hostile JWK/JWKS document to pin one CPU core for roughly 15 seconds, because the duplicate key_ops validation in jwkFields.CheckConsistency runs an all-pairs nested loop whose cost grows with the square of the entry count (CWE-407). Because that check executes on every JWK and JWKS unmarshal, any consumer that parses a JWKS body from an attacker-controlled or attacker-influenced source - a compromised or malicious identity provider, a misconfigured discovery URL, or an application that accepts a JWKS URL as user input - is exposed; the authoritative assessment rates the impact as availability-only (CVSS:3.1 AV:N/AC:H, no confidentiality or integrity effect), with the higher AC reflecting the precondition that the victim must actually fetch from the hostile endpoint rather than any attacker-uncontrolled timing condition, and notes a trusted, pinned IdP deployment is not triggerable. All releases since the earliest tag are affected on the ThalesGroup module path (>= 0.7.3, <= 0.13.0-rc1, which is deprecated and unpatched) and on the Eclipse path (< 1.0.0-rc4), with the fix first shipped in v1.0.0-rc4; there is no CISA KEV listing and no public exploit identified at time of analysis.
JwksTrustStore.Get in the Eclipse KeyPont gose JOSE library (formerly github.com/ThalesGroup/gose) can return the last key parsed from a JWKS document, with a nil error, when the caller asks for a kid that is not present in that document - so absent-key lookups silently succeed against the wrong key instead of failing as 'not found'. The flaw exists in every release from v0.7.5 through v1.0.0-rc3 of the eclipse-keypont module path, and in the deprecated ThalesGroup path up to its final tag v0.13.0-rc1; it is fixed in v1.0.0-rc4. It is not an authentication bypass: JwtVerifierImpl.Verify still enforces algorithm match and signature verification against whatever key it receives, so a token signed by an unrelated key is still rejected; the realistic impact is broken kid-to-key binding during key rotation and any downstream logic that treats kid as a trusted decision input, which is why the maintainers rate integrity impact Low with High attack complexity. There is no KEV listing and no public exploit code identified at time of analysis; the upstream advisory publishes a reproducer that demonstrates the wrong-key return against an httptest JWKS server, and the recommended handling is to fold the fix into a routine monthly patch cycle rather than an emergency response.
Denial of service in the Eclipse Keypont gose Go JWE library (published historically as github.com/ThalesGroup/gose) where AesGcmCryptor.Open forwards a caller-supplied, wire-derived nonce to crypto/cipher AEAD Open without a length check, causing the Go standard library to panic instead of returning an error. Any party able to submit a compact JWE to a gose-backed decryptor can trigger it without key material or credentials (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - they only need a kid matching a key in the decryptor's keystore, alg=dir with a matching enc, and an IV whose decoded length is anything other than 12 bytes. Impact is bounded by the caller's panic posture: under net/http the panic is recovered per request and only that request fails, while a worker, daemon or CLI without recovery has its process terminated; confidentiality and integrity are unaffected because the panic occurs before plaintext is produced. No public exploit code was identified at time of analysis, although the advisory ships a unit-test reproducer that demonstrates the panic; this_month priority, not KEV-listed.