{"id":"CVE-2026-89319","kind":"vulnerability","aliases":["CVE-2026-89319"],"related":[],"title":"Go JWE decryptor trusts attacker-supplied plaintext length, enabling crashes and memory exhaustion","description":"`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any validation. A truncated field panics `binary.BigEndian.Uint64`, an oversized value drives an unbounded allocation, and a value larger than the decrypted block panics with a slice-bounds error.","summary":"The JweDirectDecryptorBlock.Decrypt function reads a 64-bit plaintext length from the _thales_aad protected-header field without validating it. A malformed token can crash the process with a panic or cause an unbounded memory allocation.","severity":"medium","cvss":6.3,"epss":0.00207,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","jwe","package","services-decrypting-untrusted-tokens","thales"],"not_affected_if":["no-untrusted-jwe-input"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:00:05+00:00","updated_at":"2026-10-25T04:00:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:00:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Go JWE decryptor trusts attacker-supplied plaintext length, enabling crashes and memory exhaustion","impact":"low","summary":"The JweDirectDecryptorBlock.Decrypt function reads a 64-bit plaintext length from the _thales_aad protected-header field without validating it. A malformed token can crash the process with a panic or cause an unbounded memory allocation.","category":"package","nicknames":[],"who_cares":["go","jwe","thales","services-decrypting-untrusted-tokens"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the service or exhausts its memory with a crafted token","analyst_note":"Identify the affected Go module and fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-89319.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-jwe-input"],"who_is_affected":"Applications that use the affected Go JWE library to decrypt tokens or messages that may come from untrusted parties. Systems that only decrypt tokens they generate themselves, or that do not use the _thales_aad header path, are less exposed. The sources do not name the exact package or affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000583,"input_tokens":3389,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-89319':17A,20A '64':35B,69C 'aad':42B,76C 'alloc':65B,99C 'attack':6A 'attacker-suppli':5A 'binary.bigendian':91C 'bit':36B,70C 'block':107C 'bound':113C 'caus':61B 'crash':11A,54B 'cve':15A,18A 'decrypt':26B,106C 'decryptor':3A 'drive':96C 'enabl':10A 'error':114C 'exhaust':14A 'field':46B,80C,89C 'function':32B 'go':1A,21B 'header':45B,79C 'jwe':2A,22B 'jwedirectdecryptorblock.decrypt':31B,66C 'larger':103C 'length':9A,38B,72C 'malform':51B 'memori':13A,64B 'overs':94C 'packag':23B 'panic':59B,90C,108C 'plaintext':8A,37B,71C 'process':56B 'protect':44B,78C 'protected-head':43B,77C 'read':33B,67C 'servic':25B 'services-decrypting-untrusted-token':24B 'slice':112C 'slice-bound':111C 'suppli':7A 'thale':29B,41B,75C 'token':28B,52B 'truncat':88C 'trust':4A 'uint64':92C 'unbound':63B,98C 'untrust':27B 'use':82C 'valid':48B,86C 'valu':95C,102C 'without':47B,84C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the affected Go JWE library to decrypt tokens or messages that may come from untrusted parties. Systems that only decrypt tokens they generate themselves, or that do not use the _thales_aad header path, are less exposed. The sources do not name the exact package or affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89319","severity":null,"published_at":"2026-10-23T09:17:08+00:00","modified_at":"2026-10-23T19:30:07+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-89319","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-89319","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}