CVE-2026-89318

MediumCVSS 6.9/10Last modified Oct 23, 2026

Description

`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-893196.3`JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used it without any valid CVE-2026-89327.5libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited r CVE-2026-893208.8`HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES CVE-2026-893214.3Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry CVE-2026-893227.2Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allo CVE-2026-893257.8An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user t CVE-2026-893273.8The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attribu CVE-2026-893283.8The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing sever CVE-2026-893296.2A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sen CVE-2026-89337.8A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to c CVE-2026-893306.1The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnera CVE-2026-893315.3The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board featur