Eclipse Foundation Keypont vulnerabilities

• eclipse foundation keypont ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets CVE-2026-115408 5.5 MediumOctober 27, 2026
• eclipse foundation keypont - gose HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity CVE-2026-89320 8.8 HighOctober 23, 2026
• eclipse foundation keypont - gose JweDirectDecryptorBlock.Decrypt: unchecked _thales_aad length header reachable with forged tag → index-out-of-range / slice-bounds panic and unbounded allocation CVE-2026-89319 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check) CVE-2026-89318 6.9 MediumOctober 23, 2026
• eclipse foundation keypont - gose JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) CVE-2026-89317 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion CVE-2026-89316 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix CVE-2026-89315 6.9 MediumOctober 23, 2026
• eclipse foundation keypont - gose Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s CVE-2026-89314 6.9 MediumOctober 23, 2026
• eclipse foundation keypont - gose JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil CVE-2026-89313 6.3 MediumOctober 23, 2026
• eclipse foundation keypont - gose AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV CVE-2026-89312 6.9 MediumOctober 23, 2026