Live › vulnerability › CVE-2026-89314
Go to dashboardThe JWK parser checks for duplicate key_ops entries with a nested loop, so validation time grows with the square of the entry count. A hostile JWKS document with many key_ops values can keep a CPU core busy for many seconds on every unmarshal.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Services that parse JWKS or JWK documents from sources they do not fully trust, such as remote key endpoints or user-supplied keys, are the ones exposed to a hostile document. Services that only parse their own locally configured keys are unlikely to see crafted input. The sources do not name the affected library or versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
jwkFields.CheckConsistency detected duplicate key_ops entries with a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds.
This page as .md · .json · in your agent: get_signal("CVE-2026-89314")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.