CVE-2026-89318: JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)

Published Oct 23, 2026

Updated

JweRsaKeyEncryptionDecryptorImpl.Decrypt passed the JWE's initialization vector to cipher.AEAD.Open without checking its length. The Go standard library panics rather than returning an error when a GCM nonce is not exactly NonceSize() bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

Event History

Oct 23, 2026

CVE Published

via MITRE·08:51 AM

Data Sourced

via MITRE·08:51 AM

DescriptionWeakness

Frequently Asked Questions

What must an attacker provide to trigger the failure?

The attacker must cause the application to decrypt a JWE whose initialization vector has a length other than the GCM nonce size. When that IV reaches cipher.AEAD.Open, the Go standard library panics instead of returning an error.

What is the practical impact of a malformed JWE?

A malformed JWE with an attacker-chosen, wrong-sized IV crashes the goroutine performing decryption. The provided information identifies a denial-of-service condition; it does not establish exposure of plaintext or key material.

CVE-2026-89318: JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)

Event History

Frequently Asked Questions

What must an attacker provide to trigger the failure?

What is the practical impact of a malformed JWE?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker provide to trigger the failure?

What is the practical impact of a malformed JWE?