CVE-2026-89318
2026-10-23
09h17 +00:00
09h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
`JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without checking its length. The Go standard library **panics** rather than returning an error when a GCM nonce is not exactly `NonceSize()` bytes, so a JWE carrying a wrong-sized IV crashes the decrypting goroutine.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Uncaught Exception An exception is thrown from a function, but it is not caught. |
