CVE-2026-89316

MediumCVSS 6.3/10Last modified Oct 23, 2026

Description

`LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`. A JWK declaring `"kty":"EC"` together with a non-EC `"alg"` — which RFC 7517 §4.4 permits — reaches that assertion and **panics**.

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-893176.3gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose CVE-2026-893186.9`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go CVE-2026-893196.3`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any valid CVE-2026-89327.5libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited r CVE-2026-893208.8`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES CVE-2026-893214.3Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry CVE-2026-893227.2Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allo CVE-2026-893257.8An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user t CVE-2026-893273.8The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attribu CVE-2026-893283.8The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing sever CVE-2026-893296.2A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sen CVE-2026-89337.8A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to c