Live › vulnerability › CVE-2026-89320
Go to dashboardgose's HmacShaCryptor.Hash never hashed its input (misused hash.Sum), so every AES-CBC-HMAC JWE tag equals HMAC_K(""), constant per key. An attacker who has seen one valid JWE can reuse its tag on any ciphertext, so bit-flipping and padding-oracle attacks become possible. Only the CBC-HMAC direct path is affected; AEAD/GCM is not. Affected: github.com/ThalesGroup/gose v0.9.0 to v0.13.0-rc1. Fixed in commit 97f9348, shipped only as github.com/eclipse-keypont/gose >= v1.0.0-rc1.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/ThalesGroup/gose | go | >= 0.9.0, <= 0.13.0-rc1 | – |
| github.com/eclipse-keypont/gose | go | none | 1.0.0-rc1 |
v0.9.0 through v0.13.0-rc1 is affected; v0.7.3 to v0.8.7 are not)v0.13.0-rc1 with github.com/eclipse-keypont/gose v1.0.0-rc3 (v1.0.0-rc1 is the first fixed release) and rewrite all import pathsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HmacShaCryptor.Hash never hashed its input. For any input it returned HMAC_K("") — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verified by gose therefore carried an authentication tag that is constant per key and independent of the message, removing ciphertext integrity entirely.
This page as .md · .json · in your agent: get_signal("CVE-2026-89320")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.