{"id":"CVE-2026-89316","published":"2026-10-23T09:17:08.143","lastModified":"2026-10-23T19:30:07.567","description":"`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `\"kty\":\"EC\"` together with a non-EC `\"alg\"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-248"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-keypont/gose/security/advisories/GHSA-fv39-8484-f4wr","tags":[]}],"hasPoc":true,"ai":null}