MEDIUM 6.9 NVD

CVE-2026-89312

`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than r

`AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.

References

https://github.com/eclipse-keypont/gose/security/advisories/GHSA-xx6h-2jgg-93m2

Published: 2026-10-23 · Source: NVD · Feed updated: 2026-10-23

This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-23 via NVD.

vulnfeed aggregates 15176 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.