{"id":"CVE-2026-89315","kind":"vulnerability","aliases":["CVE-2026-89315"],"related":[],"title":"Go JWT library: claim names can crash JSON marshalling via reflect panic","description":"`JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `\"A\" + claimName` for each untyped claim. `reflect.StructOf` **panics** when a field name is not a valid Go identifier, or when it duplicates another field. Both conditions are reachable from ordinary JWT claim names.","summary":"The JwtClaims.MarshalJSON method builds a Go struct at runtime with reflect.StructOf, using field names derived from JWT claim names. Claim names that are not valid Go identifiers, or that duplicate another field, make the call panic, which an attacker can trigger with ordinary claim names.","severity":"medium","cvss":6.9,"epss":0.00253,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-servers","go","jwt","package"],"not_affected_if":["no-untyped-claim-marshalling"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:38:34+00:00","updated_at":"2026-10-25T03:38:34+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:38:34Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Go JWT library: claim names can crash JSON marshalling via reflect panic","impact":"low","summary":"The JwtClaims.MarshalJSON method builds a Go struct at runtime with reflect.StructOf, using field names derived from JWT claim names. Claim names that are not valid Go identifiers, or that duplicate another field, make the call panic, which an attacker can trigger with ordinary claim names.","category":"package","nicknames":[],"who_cares":["go","jwt","api-servers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Denial of service: the process panics when marshalling crafted claims","analyst_note":"Find the affected Go module, its patched versions and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-89315 to fill in how_to_check and fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untyped-claim-marshalling"],"who_is_affected":"Applications that marshal JWT claims with the affected JwtClaims type can be crashed by a crafted claim name. Services that only verify tokens and never re-serialise untyped claims through this method are less exposed. The sources do not name the affected library or versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000581,"input_tokens":3393,"output_tokens":483,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-89315':15A,18A 'anoth':55B,105C 'api':20B 'api-serv':19B 'attack':63B 'build':28B 'built':71C 'call':59B 'claim':4A,42B,44B,68B,88C,114C 'claimnam':84C 'condit':108C 'crash':7A 'cve':13A,16A 'deriv':39B 'duplic':54B,104C 'field':37B,56B,81C,93C,106C 'go':1A,22B,30B,50B,73C,99C 'identifi':51B,100C 'json':8A 'jwt':2A,23B,41B,113C 'jwtclaims.marshaljson':26B,70C 'librari':3A 'make':57B 'marshal':9A 'method':27B 'name':5A,38B,43B,45B,69B,82C,94C,115C 'ordinari':67B,112C 'packag':24B 'panic':12A,60B,90C 'reachabl':110C 'reflect':11A 'reflect.structof':35B,78C,89C 'runtim':33B,76C 'server':21B 'struct':31B,74C 'synthesis':79C 'trigger':65B 'untyp':87C 'use':36B 'valid':49B,98C 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Applications that marshal JWT claims with the affected JwtClaims type can be crashed by a crafted claim name. Services that only verify tokens and never re-serialise untyped claims through this method are less exposed. The sources do not name the affected library or versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89315","severity":null,"published_at":"2026-10-23T09:17:08+00:00","modified_at":"2026-10-23T19:30:07+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-89315","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89315","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-26T10:28:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}