CVE-2026-89316

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion…

Risk score: 40/100
CVSS: 6.3 v4.0
Exploit chance (30 days): 0.2%
Published: 23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: LoadPublicKey resolved an EC key's curve with an unchecked type assertion, algToOptsMap[alg].(*ECDSAOptions). A JWK declaring "kty":"EC" together with a non-EC "alg" — which RFC 7517 §4.4 permits — reaches that assertion and panics.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.3 medium

References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr

Original description

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.

Last activity 23 Oct 2026. Patch Forecast updates every hour.