Live › vulnerability › CVE-2026-89315
Go to dashboardThe JwtClaims.MarshalJSON method builds a Go struct at runtime with reflect.StructOf, using field names derived from JWT claim names. Claim names that are not valid Go identifiers, or that duplicate another field, make the call panic, which an attacker can trigger with ordinary claim names.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that marshal JWT claims with the affected JwtClaims type can be crashed by a crafted claim name. Services that only verify tokens and never re-serialise untyped claims through this method are less exposed. The sources do not name the affected library or versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
JwtClaims.MarshalJSON built a Go struct at runtime with reflect.StructOf, synthesising a field named "A" + claimName for each untyped claim. reflect.StructOf panics when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.
This page as .md · .json · in your agent: get_signal("CVE-2026-89315")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.